17 articles · newest first
Not most apps, but more than half of the Supabase apps a scanner could reach. The real numbers behind the headline, read on the reports' own pages, and the two-minute check that tells you whether your Lovable, Bolt or v0 app is one of them.
Aliteq Team · · 9 min
You built it by describing it to Lovable, Bolt, Cursor, Replit or v0 — the hard part's done. This is the map of the rest: understand what the AI built, fix the errors you'll Google, ship it so strangers can't break it, and handle the day a real customer shows up.
Aliteq Team · · 9 min
Yes, if it's the anon (publishable) key and Row Level Security is on for every table. Supabase built that key to be public. The one that must never show up in a browser or a repo is the secret (service_role) key. How to tell which one you found in 10 seconds, and what to do if it's the wrong one.
Aliteq Team · · 6 min
It means Row Level Security is on and no policy lets this write through. The four things that cause it in Lovable, Bolt and hand-built Supabase apps, the exact SQL that fixes each one, and why "just disable RLS" is the wrong answer. Checked against Supabase's own docs on Nov 3, 2026.
Aliteq Team · · 8 min
Before you share a Replit app, six things to check so strangers can't read each other's data or run up your bill — including the one backup check behind Replit's most infamous 2025 data-loss story.
Aliteq Team · · 7 min
v0 turns a prompt into a real Next.js app on Vercel — but who's allowed to see your data is a setting you have to confirm. Six things to check before you ship, starting with the one Next.js setting that quietly puts keys in the browser.
Aliteq Team · · 7 min
Cursor works in the project you bring, and what that project connects to is your call — so every security check is yours. Six things to confirm before you ship, and the one (reading the code) that matters most.
Aliteq Team · · 7 min
Bolt built it and its scan catches two of the big risks — but four checks are still yours before you share the link, so nobody can read each other's data or run up your AI bill.
Aliteq Team · · 7 min
Lovable scans your app when you publish, but its own docs say findings don't block publishing by default and the scans can't guarantee security. The six things to check first, where each one lives in Lovable, and how to test them without reading code. Checked on Lovable's docs Nov 3, 2026.
Aliteq Team · · 9 min
Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's the request three ways, with the real SQL each produced.
Aliteq Team · · 6 min
The naive way to vibe-code a Stripe button puts your secret key in every visitor's browser. Here's the same request three ways, with the real code — and the one rule that separates a demo from a safe checkout.
Aliteq Team · · 6 min
You don't need to write code to vibe code, but you do need to read it. Three things to look for in a diff — logged secrets, scope creep, silent data changes. Try reading one.
Aliteq Team · · 5 min
A rate limit caps how many requests someone can fire in a window, so bots, bugs and abuse can't swamp your app or your bill. Why every public endpoint needs one. Tap to watch it hold.
Aliteq Team · · 4 min
Logged in isn't the same as allowed, and the gap between the two is where data leaks. Tap the toggle to see who can read what.
Aliteq Team · · 4 min
If a service can show you your password, it stored it wrong. What a hash is, why "salt" matters, and the one red flag that tells you an app is unsafe.
Aliteq Team · · 4 min
Code models sometimes invent library names, and attackers register those names to wait for you. The research behind it, and the one check that catches it. Try spotting the fake.
Aliteq Team · · 4 min
The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.
Aliteq Team · · 8 min