ship-safely

18 articles · newest first

Hand-drawn editorial illustration of a turnstile letting one person through while a crowd of identical paper figures presses against it, a coral coin purse safe on the far side, on a near-black background in indigo-violet and off-white

Bots hammering your vibe-coded app, or a surprise API bill? The fix is a rate limit

A script can press your sign-up or AI button thousands of times, and you pay for each press. Where the limits already exist (Supabase Auth, Cloudflare), where they don't, and the spending cap that stops the bill.

Aliteq Team · Oct 4 · 7 min

Hand-drawn editorial illustration of a tired person at a laptop pulling a slot-machine lever attached to its side, a small coral spark above the lever, on a near-black background

Build

“Vibe Coding” Has Become “Doomcoding”

Beginners know they're lost, and experts can read what the AI wrote. The people in trouble are in the middle: they can prompt an app into existence but can't read what came back. So they pull the lever again. Here's the loop, the evidence, and the way out.

Aliteq Team · Oct 4 · 15 min

Hand-drawn editorial illustration of one large key with many fine threads fanning out to a crowd of small figures, each holding a glowing orb

Build

Google AI Studio will vibe code a full app for you. Two lines in its docs to read before you share it.

Google's own documentation uses the words "vibe code" for AI Studio's Build mode. It also says what happens to your API key when you deploy, and who can see your code when you share. Here's what it builds, and the checks Google's pages leave to you.

Aliteq Team · Oct 3 · 7 min

Flat illustration of a person with a magnifying glass over a wall of small identical app windows, a few marked with a coral open padlock

Build

Someone scanned 30,998 vibe-coded apps. Here's what the 57% "open Supabase" number really means.

A headline says more than half of vibe-coded apps leave their database open. The report behind it is more careful than the headline, and so is the number: what it measured, what it didn't, and the one check that matters for your app.

Aliteq Team · Oct 3 · 8 min

Hand-drawn editorial map of a vibe coder's journey from a built app to launch, with signposts along a winding path

Build

You vibe-coded an app. Here's everything to check before real people use it.

You built it by describing it to Lovable, Bolt, Cursor, Replit or v0 — the hard part's done. This is the map of the rest: understand what the AI built, fix the errors you'll Google, ship it so strangers can't break it, and handle the day a real customer shows up.

Aliteq Team · Oct 2 · 9 min

Flat illustration of a person holding two keys, a small public one and a large master key kept in a pocket

Build

Your Supabase anon key is visible in the browser. Is that a problem?

Short version: the anon (publishable) key is meant to be public — as long as Row Level Security is on. The key that must never leak is the other one. Here's how to tell which you're looking at.

Aliteq Team · Sep 26 · 6 min

Editorial illustration of a document being turned away at a guarded doorway into a filing cabinet

Build

Your app says "new row violates row-level security policy". Here's what it's protecting.

It's not a bug — it's your database refusing to let the wrong person write a row. Why the error shows up the moment security is on, and the right way to fix it (never "disable RLS").

Aliteq Team · Sep 26 · 6 min

Flat illustration of a person standing beside a large padlock and shield, ticking a short checklist

Build

The 6 things to fix in your Replit app before anyone sees it

Before you share a Replit app, six things to check so strangers can't read each other's data or run up your bill — including the one backup check behind Replit's most infamous 2025 data-loss story.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a hand over a generated app-interface mock ringed by six small padlock and shield check marks

Build

The 6 things to check in your v0 app before you ship

v0 turns a prompt into a real Next.js app on Vercel — but who's allowed to see your data is a setting you have to confirm. Six things to check before you ship, starting with the one Next.js setting that quietly puts keys in the browser.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a large text cursor beside a shield while a hand reviews lines of AI-written code

Build

The 6 things to check in your Cursor-built app before you ship

Cursor works in the project you bring, and what that project connects to is your call — so every security check is yours. Six things to confirm before you ship, and the one (reading the code) that matters most.

Aliteq Team · Sep 26 · 7 min

Flat illustration of a person beside a freshly built app running a checklist of padlocks on a workbench

Build

The 6 things to fix in your Bolt app before anyone sees it

Bolt built it and its scan catches two of the big risks — but four checks are still yours before you share the link, so nobody can read each other's data or run up your AI bill.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a person holding a magnifier over an app window ringed by small padlock and shield check marks

Build

The 6 things to fix in your Lovable app before anyone sees it

You built it by describing it to Lovable — now, before you share the link, six things to check so strangers can't read each other's data or run up your bill. Lovable helps with some; these are the rest.

Aliteq Team · Sep 26 · 7 min

Isometric diorama of a grid of table rows each with its own small lock, one row highlighted, near-black background with indigo-violet and a coral accent

Build

"Write the RLS policy for my users table": three prompts, three outcomes

Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's the request three ways, with the real SQL each produced.

Aliteq Team · Sep 26 · 6 min

Editorial infographic of a safe checkout flow: browser to a server holding a locked key, then a verified webhook, near-black background with indigo-violet and a coral accent

Build

"Add a Stripe checkout button": the prompt that leaks your secret key

The naive way to vibe-code a Stripe button puts your secret key in every visitor's browser. Here's the same request three ways, with the real code — and the one rule that separates a demo from a safe checkout.

Aliteq Team · Sep 26 · 6 min

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

BuildInteractive

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Aliteq Team · Sep 25 · 7 min

Flat illustration of two people each looking through their own window at a table, each seeing only their own coloured rows

BuildInteractive

Your Lovable app might be showing everyone's data — one setting fixes it

The single database setting behind the biggest vibe-coded app leaks, shown as a who-can-see-what table you can toggle: data wide open, then locked to its owner. The policy your AI tool should be writing.

Aliteq Team · Sep 25 · 7 min

Flat illustration of an open database cylinder with envelopes and keys floating out while a person fits a padlock

Build

The Moltbook breach: what a public Supabase key without RLS grants

An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.

Aliteq Team · Sep 25 · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Aliteq Team · Sep 25 · 8 min