app security

17 articles · newest first

Flat illustration of a person with a magnifying glass over a wall of small identical app windows, a few marked with a coral open padlock

Someone scanned 30,998 vibe-coded apps. Here's what the 57% "open Supabase" number really means.

A headline says more than half of vibe-coded apps leave their database open. The report behind it is more careful than the headline, and so is the number: what it measured, what it didn't, and the one check that matters for your app.

Aliteq Team · Oct 3 · 8 min

Hand-drawn editorial map of a vibe coder's journey from a built app to launch, with signposts along a winding path

Build

You vibe-coded an app. Here's everything to check before real people use it.

You built it by describing it to Lovable, Bolt, Cursor, Replit or v0 — the hard part's done. This is the map of the rest: understand what the AI built, fix the errors you'll Google, ship it so strangers can't break it, and handle the day a real customer shows up.

Aliteq Team · Oct 2 · 9 min

Flat illustration of a person holding two keys, a small public one and a large master key kept in a pocket

Build

Your Supabase anon key is visible in the browser. Is that a problem?

Short version: the anon (publishable) key is meant to be public — as long as Row Level Security is on. The key that must never leak is the other one. Here's how to tell which you're looking at.

Aliteq Team · Sep 26 · 6 min

Editorial illustration of a document being turned away at a guarded doorway into a filing cabinet

Build

Your app says "new row violates row-level security policy". Here's what it's protecting.

It's not a bug — it's your database refusing to let the wrong person write a row. Why the error shows up the moment security is on, and the right way to fix it (never "disable RLS").

Aliteq Team · Sep 26 · 6 min

Flat illustration of a person standing beside a large padlock and shield, ticking a short checklist

Build

The 6 things to fix in your Replit app before anyone sees it

Before you share a Replit app, six things to check so strangers can't read each other's data or run up your bill — including the one backup check behind Replit's most infamous 2025 data-loss story.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a hand over a generated app-interface mock ringed by six small padlock and shield check marks

Build

The 6 things to check in your v0 app before you ship

v0 turns a prompt into a real Next.js app on Vercel — but who's allowed to see your data is a setting you have to confirm. Six things to check before you ship, starting with the one Next.js setting that quietly puts keys in the browser.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a large text cursor beside a shield while a hand reviews lines of AI-written code

Build

The 6 things to check in your Cursor-built app before you ship

Cursor works in the project you bring, and what that project connects to is your call — so every security check is yours. Six things to confirm before you ship, and the one (reading the code) that matters most.

Aliteq Team · Sep 26 · 7 min

Flat illustration of a person beside a freshly built app running a checklist of padlocks on a workbench

Build

The 6 things to fix in your Bolt app before anyone sees it

Bolt built it and its scan catches two of the big risks — but four checks are still yours before you share the link, so nobody can read each other's data or run up your AI bill.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a person holding a magnifier over an app window ringed by small padlock and shield check marks

Build

The 6 things to fix in your Lovable app before anyone sees it

You built it by describing it to Lovable — now, before you share the link, six things to check so strangers can't read each other's data or run up your bill. Lovable helps with some; these are the rest.

Aliteq Team · Sep 26 · 7 min

Isometric diorama of a grid of table rows each with its own small lock, one row highlighted, near-black background with indigo-violet and a coral accent

Build

"Write the RLS policy for my users table": three prompts, three outcomes

Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's the request three ways, with the real SQL each produced.

Aliteq Team · Sep 26 · 6 min

Editorial infographic of a safe checkout flow: browser to a server holding a locked key, then a verified webhook, near-black background with indigo-violet and a coral accent

Build

"Add a Stripe checkout button": the prompt that leaks your secret key

The naive way to vibe-code a Stripe button puts your secret key in every visitor's browser. Here's the same request three ways, with the real code — and the one rule that separates a demo from a safe checkout.

Aliteq Team · Sep 26 · 6 min

Flat illustration of a calm person holding a large magnifying glass over a screen of code, one line gently highlighted

BuildInteractive

The AI says "I fixed the login." Here's how to check what it actually changed

You don't need to write code to vibe code, but you do need to read it. Three things to look for in a diff — logged secrets, scope creep, silent data changes. Try reading one.

Aliteq Team · Sep 26 · 5 min

Isometric diorama of a turnstile gate letting a small, steady number of figures through per minute while a crowd waits their turn behind it

BuildInteractive

One script, 10,000 fake signups overnight: the guardrail most vibe-coded apps ship without

A rate limit caps how many requests someone can fire in a window, so bots, bugs and abuse can't swamp your app or your bill. Why every public endpoint needs one. Tap to watch it hold.

Aliteq Team · Sep 26 · 4 min

Flat illustration of a person past a door marked with a checkmark, now stopped at an inner gate by a guard checking a list

BuildInteractive

The app knows who you are — that's not the same as what you're allowed to touch

Logged in isn't the same as allowed, and the gap between the two is where data leaks. Tap the toggle to see who can read what.

Aliteq Team · Sep 26 · 4 min

Flat illustration of a password going into a one-way funnel and coming out as a scrambled block, with a person unable to run it backwards

Build

A good app can't email you your own password — that's the feature

If a service can show you your password, it stored it wrong. What a hash is, why "salt" matters, and the one red flag that tells you an app is unsafe.

Aliteq Team · Sep 26 · 4 min

Flat illustration of four package boxes on a conveyor, one of them transparent and empty, with a person holding a magnifying glass

BuildInteractive

The AI told you to install a package that doesn't exist — that's a real attack

Code models sometimes invent library names, and attackers register those names to wait for you. The research behind it, and the one check that catches it. Try spotting the fake.

Aliteq Team · Sep 26 · 4 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Aliteq Team · Sep 25 · 8 min