api keys

10 articles · newest first

Flat illustration of a person holding two keys, a small public one and a large master key kept in a pocket

Your Supabase anon key is visible in the browser. Is that a problem?

Short version: the anon (publishable) key is meant to be public — as long as Row Level Security is on. The key that must never leak is the other one. Here's how to tell which you're looking at.

Aliteq Team · Sep 26 · 6 min

Flat illustration of a person standing beside a large padlock and shield, ticking a short checklist

Build

The 6 things to fix in your Replit app before anyone sees it

Before you share a Replit app, six things to check so strangers can't read each other's data or run up your bill — including the one backup check behind Replit's most infamous 2025 data-loss story.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a hand over a generated app-interface mock ringed by six small padlock and shield check marks

Build

The 6 things to check in your v0 app before you ship

v0 turns a prompt into a real Next.js app on Vercel — but who's allowed to see your data is a setting you have to confirm. Six things to check before you ship, starting with the one Next.js setting that quietly puts keys in the browser.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a large text cursor beside a shield while a hand reviews lines of AI-written code

Build

The 6 things to check in your Cursor-built app before you ship

Cursor works in the project you bring, and what that project connects to is your call — so every security check is yours. Six things to confirm before you ship, and the one (reading the code) that matters most.

Aliteq Team · Sep 26 · 7 min

Flat illustration of a person beside a freshly built app running a checklist of padlocks on a workbench

Build

The 6 things to fix in your Bolt app before anyone sees it

Bolt built it and its scan catches two of the big risks — but four checks are still yours before you share the link, so nobody can read each other's data or run up your AI bill.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a person holding a magnifier over an app window ringed by small padlock and shield check marks

Build

The 6 things to fix in your Lovable app before anyone sees it

You built it by describing it to Lovable — now, before you share the link, six things to check so strangers can't read each other's data or run up your bill. Lovable helps with some; these are the rest.

Aliteq Team · Sep 26 · 7 min

Flat illustration of a person pointing at an item on a large menu while a kitchen hatch passes out a plate

BuildInteractive

An API is a menu of requests a server agrees to accept — order off it

Why your app talks to other companies' servers (OpenAI, Stripe), what an API key really is, and why the kitchen has to check every order. Tap through the menu.

Aliteq Team · Sep 25 · 4 min

Flat illustration of a person dropping a key into a locked drawer under a desk, with a dotted line to a small server

Build

The one file you must never commit — and the trap that ships secrets to the browser

Your app's keys live in labelled envelopes outside the code. Which envelopes the browser gets a copy of (VITE_, NEXT_PUBLIC_), where secret keys actually belong, and the .env file you keep out of git.

Aliteq Team · Sep 25 · 6 min

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

BuildInteractive

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Aliteq Team · Sep 25 · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Aliteq Team · Sep 25 · 8 min