10 articles · newest first
Yes, if it's the anon (publishable) key and Row Level Security is on for every table. Supabase built that key to be public. The one that must never show up in a browser or a repo is the secret (service_role) key. How to tell which one you found in 10 seconds, and what to do if it's the wrong one.
Aliteq Team · · 6 min
Before you share a Replit app, six things to check so strangers can't read each other's data or run up your bill — including the one backup check behind Replit's most infamous 2025 data-loss story.
Aliteq Team · · 7 min
v0 turns a prompt into a real Next.js app on Vercel — but who's allowed to see your data is a setting you have to confirm. Six things to check before you ship, starting with the one Next.js setting that quietly puts keys in the browser.
Aliteq Team · · 7 min
Cursor works in the project you bring, and what that project connects to is your call — so every security check is yours. Six things to confirm before you ship, and the one (reading the code) that matters most.
Aliteq Team · · 7 min
Bolt built it and its scan catches two of the big risks — but four checks are still yours before you share the link, so nobody can read each other's data or run up your AI bill.
Aliteq Team · · 7 min
Lovable scans your app when you publish, but its own docs say findings don't block publishing by default and the scans can't guarantee security. The six things to check first, where each one lives in Lovable, and how to test them without reading code. Checked on Lovable's docs Nov 3, 2026.
Aliteq Team · · 9 min
Why your app talks to other companies' servers (OpenAI, Stripe), what an API key really is, and why the kitchen has to check every order. Tap through the menu.
Aliteq Team · · 4 min
Your app's keys live in labelled envelopes outside the code. Which envelopes the browser gets a copy of (VITE_, NEXT_PUBLIC_), where secret keys actually belong, and the .env file you keep out of git.
Aliteq Team · · 6 min
Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.
Aliteq Team · · 7 min
The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.
Aliteq Team · · 8 min