ship-safely

27 articles · newest first

Flat vector illustration of a person kneeling to slide one block out of a leaning tower of stacked blocks, with a single coral block balanced on top, on an indigo background

Every new feature breaks something else? Fix the technical debt in your AI-built app

Your app worked last week. Now each change breaks two other things. That's technical debt, a term its inventor says people often misread. What he meant, what two studies found about AI-written code, and a seven-step cleanup order.

Aliteq Team · 2h ago · 9 min

Flat illustration of a person reaching toward a giant shipping box on a conveyor belt, a coral key already sealed inside it, on a flat indigo-violet background

Build

Your Vite app says undefined on Vercel? The variable missed the build

You pasted the key into Vercel or Netlify, the dashboard shows it, and the live app still reads undefined. Vite writes those values into your code when it builds, so the fix is a prefix and a redeploy. Plus the part nobody mentions: everything named VITE_ is public.

Aliteq Team · 2h ago · 9 min

Hand-drawn editorial illustration of a key that almost fits a lock on a dark background, in violet, lavender and coral

Build

"Error 400: redirect_uri_mismatch" after adding Google login? The two lists to fix

You added Sign in with Google and Google blocked the very first click. The error is a safety check, not a bug. Where the address has to match, why it must match exactly, and the fix for Supabase, localhost and preview links.

Aliteq Team · 2h ago · 12 min

Flat vector illustration of a person holding a laptop on a cliff edge, facing a large blank red stop sign that stands between two separated platforms, on an indigo-violet background

Build

'Blocked by CORS policy' in Lovable, Bolt or Cursor? Fix it on the server

That red console error means your browser stopped your own app from reading a reply. What CORS actually is, why the quick "allow everything" fixes backfire, and the right fix for Supabase functions and Next.js.

Aliteq Team · 2h ago · 9 min

Hand-drawn editorial illustration of a uniformed doorkeeper holding up a hand mirror at an arched violet door; the mirror shows him holding a mirror, repeating into an endless tunnel, while a coral padlock hangs on the door, on a near-black background

Build

"infinite recursion detected in policy" in Supabase? Your admin check is asking itself

Your Lovable or Bolt app got an admin check, and now every read of that table fails with error 42P17. The policy is reading the table it protects, so Postgres stops the loop. The fix Supabase documents keeps RLS on and takes one small function. Plus the three quick fixes that hand your data to anyone.

Aliteq Team · 3d ago · 8 min

Hand-drawn illustration of a robotic hand passing a clipboard with five empty checkboxes, one ticked in coral, to a human hand

Build

Before you ship what Cursor or Lovable wrote: a 5-check code review for non-coders

The AI says it's done and the app runs. That tells you almost nothing about whether it's safe. Five checks, each a question you can ask or a screen you can open, on secrets, who's allowed in, user input, invented packages and errors.

Aliteq Team · 5d ago · 8 min

Hand-drawn editorial illustration of a new wooden table wrapped in a coral chain and padlock, with a hand reaching in from the side holding a small key, on a near-black background in indigo-violet and off-white

Build

"permission denied for table" in Supabase? From Oct 30, every new table needs a grant

Your vibe-coded app added a table and Supabase now answers with error 42501. A new table can be locked before Row Level Security even runs. On 30 October 2026 that becomes the rule for every existing project. The one safe fix, and the two popular fixes that open your data to anyone.

Aliteq Team · 6d ago · 8 min

Photo of a power cord running from a wall outlet across a dark floor, with a single amber night-light glowing in the background

Build

Your vibe-coded app went down and nobody told you: the 5 boring reasons

Expired certificates, free-plan limits, paused databases, too many connections and no backup. None are glamorous, all are in the vendors' own docs, and one gave our own site error pages for days.

Aliteq Team · Oct 8 · 8 min

Flat illustration of a person holding a large open padlock shaped like a document, beside a laptop showing a code symbol

Build

Did your AI add GPL code to your app? What MIT, Apache, GPL and AGPL require

Your AI tool pulls in packages and writes code without ever showing you a license. Here is what the four common open-source licenses ask of you, what the US Copyright Office says about who owns AI-written code, and a four-step check before you go live.

Aliteq Team · Oct 6 · 8 min

Hand-drawn editorial illustration of a turnstile letting one person through while a crowd of identical paper figures presses against it, a coral coin purse safe on the far side, on a near-black background in indigo-violet and off-white

Build

Bots hammering your vibe-coded app, or a surprise API bill? The fix is a rate limit

A script can press your sign-up or AI button thousands of times, and you pay for each press. Where the limits already exist (Supabase Auth, Cloudflare), where they don't, and the spending cap that stops the bill.

Aliteq Team · Oct 4 · 7 min

Hand-drawn editorial illustration of a tired person at a laptop pulling a slot-machine lever attached to its side, a small coral spark above the lever, on a near-black background

Build

“Vibe Coding” Has Become “Doomcoding”

Beginners know they're lost, and experts can read what the AI wrote. The people in trouble are in the middle: they can prompt an app into existence but can't read what came back. So they pull the lever again. Here's the loop, the evidence, and the way out.

Aliteq Team · Oct 4 · 15 min

Hand-drawn editorial illustration of one large key with many fine threads fanning out to a crowd of small figures, each holding a glowing orb

Build

Google AI Studio will vibe code a full app for you. Two lines in its docs to read before you share it.

Google's own documentation uses the words "vibe code" for AI Studio's Build mode. It also says what happens to your API key when you deploy, and who can see your code when you share. Here's what it builds, and the checks Google's pages leave to you.

Aliteq Team · Oct 3 · 7 min

Flat illustration of a person with a magnifying glass over a wall of small identical app windows, a few marked with a coral open padlock

Build

Someone scanned 30,998 vibe-coded apps. Here's what the 57% "open Supabase" number really means.

A headline says more than half of vibe-coded apps leave their database open. The report behind it is more careful than the headline, and so is the number: what it measured, what it didn't, and the one check that matters for your app.

Aliteq Team · Oct 3 · 8 min

Hand-drawn editorial map of a vibe coder's journey from a built app to launch, with signposts along a winding path

Build

You vibe-coded an app. Here's everything to check before real people use it.

You built it by describing it to Lovable, Bolt, Cursor, Replit or v0 — the hard part's done. This is the map of the rest: understand what the AI built, fix the errors you'll Google, ship it so strangers can't break it, and handle the day a real customer shows up.

Aliteq Team · Oct 2 · 9 min

Flat illustration of a person holding two keys, a small public one and a large master key kept in a pocket

Build

Your Supabase anon key is visible in the browser. Is that a problem?

Short version: the anon (publishable) key is meant to be public — as long as Row Level Security is on. The key that must never leak is the other one. Here's how to tell which you're looking at.

Aliteq Team · Sep 26 · 6 min

Editorial illustration of a document being turned away at a guarded doorway into a filing cabinet

Build

Your app says "new row violates row-level security policy". Here's what it's protecting.

It's not a bug — it's your database refusing to let the wrong person write a row. Why the error shows up the moment security is on, and the right way to fix it (never "disable RLS").

Aliteq Team · Sep 26 · 6 min

Flat illustration of a person standing beside a large padlock and shield, ticking a short checklist

Build

The 6 things to fix in your Replit app before anyone sees it

Before you share a Replit app, six things to check so strangers can't read each other's data or run up your bill — including the one backup check behind Replit's most infamous 2025 data-loss story.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a hand over a generated app-interface mock ringed by six small padlock and shield check marks

Build

The 6 things to check in your v0 app before you ship

v0 turns a prompt into a real Next.js app on Vercel — but who's allowed to see your data is a setting you have to confirm. Six things to check before you ship, starting with the one Next.js setting that quietly puts keys in the browser.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a large text cursor beside a shield while a hand reviews lines of AI-written code

Build

The 6 things to check in your Cursor-built app before you ship

Cursor works in the project you bring, and what that project connects to is your call — so every security check is yours. Six things to confirm before you ship, and the one (reading the code) that matters most.

Aliteq Team · Sep 26 · 7 min

Flat illustration of a person beside a freshly built app running a checklist of padlocks on a workbench

Build

The 6 things to fix in your Bolt app before anyone sees it

Bolt built it and its scan catches two of the big risks — but four checks are still yours before you share the link, so nobody can read each other's data or run up your AI bill.

Aliteq Team · Sep 26 · 7 min

Editorial illustration of a person holding a magnifier over an app window ringed by small padlock and shield check marks

Build

The 6 things to fix in your Lovable app before anyone sees it

You built it by describing it to Lovable — now, before you share the link, six things to check so strangers can't read each other's data or run up your bill. Lovable helps with some; these are the rest.

Aliteq Team · Sep 26 · 7 min

Isometric diorama of a grid of table rows each with its own small lock, one row highlighted, near-black background with indigo-violet and a coral accent

Build

"Write the RLS policy for my users table": three prompts, three outcomes

Row Level Security is deny-by-default, so the danger isn't forgetting to lock a table — it's a lazy policy that quietly unlocks all of them. Here's the request three ways, with the real SQL each produced.

Aliteq Team · Sep 26 · 6 min

Editorial infographic of a safe checkout flow: browser to a server holding a locked key, then a verified webhook, near-black background with indigo-violet and a coral accent

Build

"Add a Stripe checkout button": the prompt that leaks your secret key

The naive way to vibe-code a Stripe button puts your secret key in every visitor's browser. Here's the same request three ways, with the real code — and the one rule that separates a demo from a safe checkout.

Aliteq Team · Sep 26 · 6 min

Flat illustration of a browser window with a hidden compartment showing a key, while a person moves a key into a safe

BuildInteractive

Your API keys are in the browser: which ones matter and the fix

Whatever your app sends to the browser, anyone can read. Which keys are designed to be public, which must never be, how secrets end up there, and the server-function fix, from each vendor's own docs.

Aliteq Team · Sep 25 · 7 min

Flat illustration of two people each looking through their own window at a table, each seeing only their own coloured rows

BuildInteractive

Your Lovable app might be showing everyone's data — one setting fixes it

The single database setting behind the biggest vibe-coded app leaks, shown as a who-can-see-what table you can toggle: data wide open, then locked to its owner. The policy your AI tool should be writing.

Aliteq Team · Sep 25 · 7 min

Flat illustration of an open database cylinder with envelopes and keys floating out while a person fits a padlock

Build

The Moltbook breach: what a public Supabase key without RLS grants

An AI-built social network left its whole database readable and writable. The key wasn't stolen; one setting was missing. What happened, from Wiz's write-up, and the lesson for anyone building on Supabase.

Aliteq Team · Sep 25 · 7 min

Flat illustration of a person with a clipboard checking padlock and shield icons around a laptop

Build

Before you share your vibe-coded app: the 6 security checks

The six mistakes behind 2026's vibe-coded app exposures, turned into checks you can do without reading code: RLS, secrets, server-side auth, admin, webhooks and rate limits.

Aliteq Team · Sep 25 · 8 min