26 articles · newest first
Your app worked last week. Now each change breaks two other things. That's technical debt, a term its inventor says people often misread. What he meant, what two studies found about AI-written code, and a seven-step cleanup order.
Aliteq Team · · 9 min
You pasted the key into Vercel or Netlify, the dashboard shows it, and the live app still reads undefined. Vite writes those values into your code when it builds, so the fix is a prefix and a redeploy. Plus the part nobody mentions: everything named VITE_ is public.
Aliteq Team · · 9 min
You added Sign in with Google and Google blocked the very first click. The error is a safety check, not a bug. Where the address has to match, why it must match exactly, and the fix for Supabase, localhost and preview links.
Aliteq Team · · 12 min
That red console error means your browser stopped your own app from reading a reply. What CORS actually is, why the quick "allow everything" fixes backfire, and the right fix for Supabase functions and Next.js.
Aliteq Team · · 9 min
Your Lovable or Bolt app got an admin check, and now every read of that table fails with error 42P17. The policy is reading the table it protects, so Postgres stops the loop. The fix Supabase documents keeps RLS on and takes one small function. Plus the three quick fixes that hand your data to anyone.
Aliteq Team · · 8 min
The AI says it's done and the app runs. That tells you almost nothing about whether it's safe. Five checks, each a question you can ask or a screen you can open, on secrets, who's allowed in, user input, invented packages and errors.
Aliteq Team · · 8 min
Your vibe-coded app added a table and Supabase now answers with error 42501. A new table can be locked before Row Level Security even runs. On October 30, 2026 that becomes the rule for every existing project. The one safe fix, and the two popular fixes that open your data to anyone.
Aliteq Team · · 8 min
Expired certificates, free-plan limits, paused databases, too many connections and no backup. None are glamorous, all are in the vendors' own docs, and one gave our own site error pages for days.
Aliteq Team · · 8 min
Your AI tool pulls in packages and writes code without ever showing you a license. Here is what the four common open-source licenses ask of you, what the US Copyright Office says about who owns AI-written code, and a four-step check before you go live.
Aliteq Team · · 8 min
A script can press your sign-up or AI button thousands of times, and you pay for each press. Where the limits already exist (Supabase Auth, Cloudflare), where they don't, and the spending cap that stops the bill.
Aliteq Team · · 7 min
Vibe coding in Google AI Studio's Build mode costs nothing, and eligible accounts can publish two full-stack apps without a billing account. The catches are in Google's own docs: which Gemini models are free, the shared database quota, who pays for your visitors' AI calls, and what Google does with free-tier prompts.
Aliteq Team · · 9 min
Not most apps, but more than half of the Supabase apps a scanner could reach. The real numbers behind the headline, read on the reports' own pages, and the two-minute check that tells you whether your Lovable, Bolt or v0 app is one of them.
Aliteq Team · · 9 min
You built it by describing it to Lovable, Bolt, Cursor, Replit or v0 — the hard part's done. This is the map of the rest: understand what the AI built, fix the errors you'll Google, ship it so strangers can't break it, and handle the day a real customer shows up.
Aliteq Team · · 9 min
Yes, if it's the anon (publishable) key and Row Level Security is on for every table. Supabase built that key to be public. The one that must never show up in a browser or a repo is the secret (service_role) key. How to tell which one you found in 10 seconds, and what to do if it's the wrong one.
Aliteq Team · · 6 min
It means Row Level Security is on and no policy lets this write through. The four things that cause it in Lovable, Bolt and hand-built Supabase apps, the exact SQL that fixes each one, and why "just disable RLS" is the wrong answer. Checked against Supabase's own docs on Nov 3, 2026.
Aliteq Team · · 8 min
Before you share a Replit app, six things to check so strangers can't read each other's data or run up your bill — including the one backup check behind Replit's most infamous 2025 data-loss story.
Aliteq Team · · 7 min
v0 turns a prompt into a real Next.js app on Vercel — but who's allowed to see your data is a setting you have to confirm. Six things to check before you ship, starting with the one Next.js setting that quietly puts keys in the browser.
Aliteq Team · · 7 min
Cursor works in the project you bring, and what that project connects to is your call — so every security check is yours. Six things to confirm before you ship, and the one (reading the code) that matters most.
Aliteq Team · · 7 min
Bolt built it and its scan catches two of the big risks — but four checks are still yours before you share the link, so nobody can read each other's data or run up your AI bill.
Aliteq Team · · 7 min
Lovable scans your app when you publish, but its own docs say findings don't block publishing by default and the scans can't guarantee security. The six things to check first, where each one lives in Lovable, and how to test them without reading code. Checked on Lovable's docs Nov 3, 2026.
Aliteq Team · · 9 min
Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's the request three ways, with the real SQL each produced.
Aliteq Team · · 6 min
The naive way to vibe-code a Stripe button puts your secret key in every visitor's browser. Here's the same request three ways, with the real code — and the one rule that separates a demo from a safe checkout.
Aliteq Team · · 6 min
Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.
Aliteq Team · · 7 min
If a Supabase table has Row Level Security off, anyone with your app's public key can read and write every row. How to check every table in two minutes, the SQL that turns RLS on and keeps it working, and the gotchas Supabase changed this year. Checked on Supabase's and Lovable's own docs, Nov 3, 2026.
Aliteq Team · · 9 min
An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.
Aliteq Team · · 7 min
The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.
Aliteq Team · · 8 min