Guides
Is My Vibe-Coded App Safe to Launch? A 15-Point Security Checklist
Built with Lovable, Bolt, Cursor, Claude, Grok or ChatGPT? Work through this pre-launch security checklist: secrets, Supabase RLS, auth, payments and dependencies.
npm audit for Vibe Coders: What the Warnings Mean and What to Actually Fix
Your Lovable, Bolt, Cursor, Claude, Grok or ChatGPT app says '12 vulnerabilities'? How to read npm audit, what to fix first, and when npm audit fix --force is risky.
OpenAI or Stripe API Key Exposed in Frontend Code? Why It Happens and How to Fix It
VITE_OPENAI_API_KEY or a Stripe secret key in your React app is public. Learn why Vite and Next.js ship it to every visitor, how to rotate it, and how to move calls server-side.
Committed Your .env File? How to Remove It From Git History and Rotate Your Keys
Accidentally pushed a .env file to GitHub? Here's the right order: rotate keys first, then remove the file from git history with git-filter-repo, and stop it happening again.
Supabase service_role Key Leaked in Your Lovable or Bolt App? Here's the Fix
Found your Supabase service_role key in frontend code or GitHub? Learn why it's critical, how to rotate it, move it server-side, and lock down Row Level Security.
Built it with Lovable, Bolt, Cursor, Claude, Grok or ChatGPT? Is your repo safe to ship?
Paste a public GitHub repo, or connect GitHub for a private one, and get a risk score in under a minute. Free.