Security checklists by platform

Step-by-step checklists for the stacks AI app builders use most, with copy-paste SQL and config, and sources linked.

See a sample report : a real scan of our own test app, with fake secrets planted on purpose.

A practical security checklist for apps built with Lovable: Supabase RLS policies, secret keys, edge functions, storage buckets, headers and what Lovable's built-in security scan does and doesn't cover.

Bolt.new security checklist

Security checklist for apps built with Bolt.new: Bolt Database vs Supabase, VITE_ environment variables, Netlify secrets, edge functions for Stripe, headers and source maps.

v0 / Next.js on Vercel security checklist

Security checklist for Next.js apps generated with v0 or Cursor and deployed on Vercel: NEXT_PUBLIC_ variables, server actions and route handlers, sensitive env vars, headers, deployment protection.

Supabase RLS check for vibe coders

Six copy-paste SQL queries to find Supabase tables without Row Level Security, policies that allow everyone, public storage buckets, RLS-bypassing views and SECURITY DEFINER functions, plus owner-only policy templates.

Firebase security rules checklist

Checklist for Firestore, Realtime Database and Cloud Storage rules in AI-built Firebase apps: test-mode rules, request.auth checks, ownership, App Check and testing with the emulator.

Is my Stripe secret key exposed?

How to check whether your Stripe secret key (sk_live_), restricted key (rk_) or webhook secret (whsec_) is exposed in your app's front-end code, and what to do if it is.

Replit app security checklist

Security checklist for apps built with Replit Agent: the Secrets tool vs configurations, production app secrets, Security Center scan levels, blocking publishing on critical findings, app access and database access rules.

Cursor-built app security checklist

Security checklist for apps built with Cursor: keep .env files out of the agent's context with .cursorignore, keep secrets out of client bundles (NEXT_PUBLIC_/VITE_), review auth on generated API routes, and scan before you ship.

Exposed OpenAI API key: what to do

Your OpenAI API key (sk-proj-...) is in your front-end code, a public repo or a screenshot. Rotate it, check usage, set project spend limits, move calls server-side and prevent it happening again.

Supabase anon key vs service role key

Which Supabase key is safe in the browser? The anon / publishable (sb_publishable_) key is public and limited by RLS; the service_role / secret (sb_secret_) key bypasses RLS and must stay on the server. How to tell them apart and what to do if one leaks.

Is my Firebase API key a secret?

Your Firebase web apiKey is public by design and safe in client code, as long as it's restricted to Firebase APIs and your data is protected by Security Rules. A Gemini or other Google Cloud key in the same bundle is a real leak. How to tell them apart.

Supabase RLS disabled: data leak check

If a Supabase table in an exposed schema has Row Level Security disabled, anyone with your public anon/publishable key can read and write it through the Data API. How to check your own project, the SQL to fix it (enable RLS, revoke grants, add policies) and how to stop it happening to the next table.

Unspill vs Lovable Security Scan vs Supabase Security Advisor

An honest comparison of three free security checks for AI-built apps: Lovable's built-in Security Scan, Supabase's Security Advisor and Unspill's outside-in scan. What each one looks at, its blind spots, and when to use which. Sourced from the official docs.