Fundamentals··7 min read
The 7 Most Common Security Holes in AI-Generated Apps
AI coding tools ship the same handful of security mistakes over and over. Here are the seven that get vibe-coded apps hacked — and how to catch each one.
Read articleThe Secure The Vibe blog
Plain-English security guides for apps built with AI. Supabase RLS, leaked API keys, security headers, and the mistakes Cursor & Claude make.
Supabase··6 min read
How to Tell If Your Supabase Database Is Publicly Exposed
Your Supabase anon key is public by design — so what actually protects your data? A plain-English guide to checking whether your tables are wide open.
Read articleSecrets··6 min read
Stop Leaking API Keys: A Vibe Coder's Guide to Secrets
Leaked API keys are the number-one way AI-built apps get drained. Learn where keys hide, how attackers find them, and how to keep secrets server-side.
Read articleSupabase··8 min read
Row Level Security in Supabase, Explained for Non-Experts
RLS is the feature that keeps your Supabase data private — and the one most vibe coders skip. A plain-language walkthrough with copy-paste policies.
Read articleSecrets··5 min read
Why Your .env File Might Be Public (and How to Check)
A publicly served .env file hands attackers every secret at once. Here's how it happens on modern hosts and how to confirm yours isn't exposed.
Read articleHeaders··7 min read
Security Headers Every Web App Needs (CSP, HSTS, and Friends)
CSP, HSTS, X-Frame-Options and more — what each security header does, why it matters, and the safe values to start with on a vibe-coded app.
Read articleFirebase··6 min read
Firebase Security Rules: The Defaults That Will Burn You
Firestore and Realtime Database start in test mode — open to the world. Learn the default traps and how to write rules that actually protect your data.
Read articleSupabase··5 min read
Is It Safe to Expose Your Supabase Anon Key? Yes — Here's Why
Panicking because your Supabase anon key is visible in the browser? It's supposed to be. Here's what the anon key can and can't do — and what to guard instead.
Read articleChecklists··6 min read
A 10-Minute Security Checklist Before You Ship Your Vibe-Coded App
About to launch something an AI built? Run this fast, practical checklist first — secrets, database rules, headers, and exposed files, all in ten minutes.
Read articleNext.js··7 min read
Next.js Security Mistakes AI Assistants Make
From leaking secrets with NEXT_PUBLIC_ to skipping server-side auth checks, here are the Next.js-specific traps AI assistants fall into — and the fixes.
Read articleFind your security holes before someone else does
Free scan, plain-language report, copy-paste fixes. About 30 seconds.
Scan my app