Menu

Guides

Guides

Longer notes for the failures that show up when an AI coding tool ships a real backend: keys in the bundle, open rules, and routes with no auth check.

Newest first. Want to see what your deployed app already exposes? Try the free Live App Scanner. New guides go out in the newsletter every week.

  1. 01GuideClient-side auth is not security: protect your admin pageA JS role check, localStorage flag, or email gate only hides your admin page. Enforce roles on the server with Supabase RLS, Next.js, Firebase, or Clerk.
  2. 02GuideHow to hide API keys in an Expo or React Native appEXPO_PUBLIC_ and .env values ship inside your app. Which keys are safe in a mobile bundle, and how to move OpenAI and secret keys to a server proxy.
  3. 03GuideStop brute force and credential stuffing on your loginRate limits, CAPTCHA, lockout, and MFA for Supabase, Clerk, Firebase, and Auth.js logins, plus generic errors and a safe way to test your own app.
  4. 04GuideMCP server security: what to check before you install oneBefore you add an MCP server to Cursor, Claude Code, or VS Code: tool poisoning, prompt injection, rug pulls, leaked tokens, and settings that limit damage.
  5. 05GuideFix 'infinite recursion detected in policy for relation' in SupabaseWhy Supabase RLS throws 42P17 infinite recursion, the safe private security definer fix, and the AI quick fixes that quietly open your data.
  6. 06GuideSupabase Security Advisor warnings explained and fixedWhat each Supabase Security Advisor lint means, which ones are urgent, and the SQL fix: RLS disabled, mutable search_path, definer views, and more.
  7. 07GuideFirestore allow read, write: if true makes your data publicWhat Firebase test mode and if true rules really allow, how to check whether your Firestore or Storage is open to the public, and the rules to deploy instead.
  8. 08GuideSQL injection in Prisma, Drizzle, and SupabaseFix SQL injection in Prisma, Drizzle, and Supabase: tagged templates, never sql.raw with user input, and parameterize Postgres functions called via rpc.
  9. 09GuideSupabase Edge Function auth: verify JWT and callersSecure Supabase Edge Functions: what verify_jwt does not prove, getClaims vs getUser, secret key safety, signed webhooks, CORS, and rate limits.
  10. 10GuideSupabase Realtime authorization: private channels and RLSSecure Supabase Realtime: private channels, RLS on realtime.messages for Broadcast and Presence, postgres_changes, and vibe-coded mistakes.
  11. 11GuideSupabase Realtime: broadcast from the databaseHarden Supabase Realtime broadcast from Postgres: realtime.send, broadcast_changes, private channels, payload leakage, and vibe-coded trigger mistakes.
  12. 12GuideSupabase views and functions that bypass RLSFix Supabase views and SECURITY DEFINER functions that skip RLS: set security_invoker, pin search_path, revoke EXECUTE, and test as anon.
  13. 13GuideHow to test Supabase RLS policies in CI with pgTAPTest Supabase RLS with pgTAP and supabase test db: block anon and cross-tenant access, fail CI on tables without RLS, and run it all in GitHub Actions.
  14. 14GuideAI hallucinated packages and slopsquattingAI coding tools sometimes suggest npm or PyPI packages that do not exist, and attackers register the names. How it works, and a quick check before you install.
  15. 15GuideAUTH_SECRET and NEXTAUTH_SECRET: set and rotateAuth.js needs AUTH_SECRET (NEXTAUTH_SECRET in older NextAuth) on the server only. What it encrypts, how to generate a strong value, and how to rotate it safely.
  16. 16GuideCORS misconfiguration in vibe-coded appsAI tools often 'fix' CORS errors by allowing every origin or turning on credentials. What is dangerous in Next.js, Express, and Supabase, plus safe configs.
  17. 17GuideContent-Security-Policy for vibe-coded appsWhere to set a CSP header on Next.js, Vercel, and static hosts, a starter policy, what breaks with Stripe, Clerk, and Supabase, and a safe Report-Only rollout.
  18. 18GuideIs your .env, .git, or source code public?How vibe-coded apps end up serving .env files, .git folders, and source maps, a five-minute check for your site, and fixes for Vercel, Netlify, and Cloudflare.
  19. 19GuideFix IDOR (BOLA) in Next.js and SupabaseFix IDOR in Next.js Route Handlers and Supabase: get the user from a verified session, scope every query by owner, add RLS, and test with a second account.
  20. 20GuideFix open redirects in Auth.js, Supabase, and ClerkAI-built login flows often redirect to any callbackUrl, redirectTo, or next value in the URL, sending users to phishing sites. How to allow-list redirects.
  21. 21GuidePrompt injection defense for vibe-coded AI appsIf your app sends user text, files, or web pages to an LLM, someone can hijack it. How prompt injection hits chatbots, RAG, and agents, and how to limit it.
  22. 22GuideRate limit AI API routes: Next.js and SupabaseRate limiting for OpenAI and other LLM routes: per-user and per-IP limits with Upstash, daily token budgets, Supabase Edge Functions, and provider spend caps.
  23. 23GuideSecure file uploads in Next.js and SupabaseStop uploads that trust file.type, skip auth, or land in public/. Use direct-to-storage uploads, MIME allow-lists, safe filenames, and private storage buckets.
  24. 24GuideSecure Vercel Cron jobs with CRON_SECRETAI-generated apps often leave /api/cron routes open. How Vercel sends CRON_SECRET as a Bearer token, how to return 401 to other callers, and fail-open bugs.
  25. 25GuideXSS in React and Next.js: dangerouslySetInnerHTMLReact escapes JSX text, but dangerouslySetInnerHTML, rehype-raw, and AI chat output can still run attacker scripts. Sanitize with DOMPurify and allow-list URLs.
  26. 26GuideClerk publishable key vs secret keyYour Clerk pk_ key is fine in frontend code; your sk_ key and whsec_ secret are not. The right env var names for Next.js and Vite, and how to rotate a leak.
  27. 27GuideIs it safe to expose your Firebase API key?Why the Firebase web API key is public by design, the one restriction that makes it dangerous, and how Security Rules and App Check actually protect your data.
  28. 28GuideNext.js middleware auth bypass CVE-2025-29927CVE-2025-29927 let one header skip Next.js middleware auth checks. Affected versions, the patched releases, who is safe, and how to fix your app.
  29. 29GuideRemove a leaked API key from GitHub historyRotate the key first, then purge it from every commit with git filter-repo or BFG, force-push carefully, and clean up clones, forks, and GitHub's cached views.
  30. 30GuideStripe paywall bypass on the success pageIf your app grants paid access when someone lands on ?success=true, anyone can type that URL. Unlock features only from verified Stripe data, using webhooks.
  31. 31GuideSupabase Auth security settings before launchSupabase Auth settings AI-built apps leave on defaults: Site URL, redirects, email confirmation, password rules, leaked password checks, and reauthentication.
  32. 32GuideSecure Vercel preview deployments and env varsPreview URLs can expose unfinished features and production data. Set Deployment Protection, split Preview and Production env vars, and use Secret variables.
  33. 33GuideHow to check if your API key leaked on GitHubSearch your repo, your git history, and GitHub's own alerts for exposed API keys, then know what to do when you find one, starting with rotation.
  34. 34GuideEnv variables in Cursor, Bolt.new, and LovableWhich env vars end up in the browser, how to keep .env files away from AI agents and git, and where server secrets belong in Cursor, Bolt.new, and Lovable.
  35. 35GuideNext.js Server Actions securityServer Actions are public HTTP endpoints. How to add authentication, authorization, and input validation so AI generated actions are safe to ship.
  36. 36GuideStop strangers from running up your OpenAI billYour AI API route is a free proxy to your OpenAI or Anthropic account until you lock it down. Auth, rate limits, input caps, and spend limits.
  37. 37GuideReplit Secrets guideHow to store API keys in Replit Secrets, read them safely in code, and avoid leaking them through public Repls, frontends, and logs.
  38. 38GuideA security review prompt for AI coding toolsA copy-paste prompt that asks an AI coding tool for a security review, plus how to read the answer without trusting it blindly.
  39. 39GuideSupabase anon key vs service role keyWhich Supabase key is safe in the browser, which one bypasses Row Level Security, and where each belongs in a Lovable, Bolt, or Next.js app.
  40. 40GuideSupabase Storage security: buckets and RLSStop strangers from listing, downloading, or overwriting files in Supabase Storage, with policies for per-user folders and signed URLs.
  41. 41GuideCommon vulnerabilities in vibe-coded appsHow IDOR, exposed service role keys, and missing auth on API routes show up in apps built with AI coding tools, and how to fix each one.
  42. 42GuideSecuring Stripe webhooksVerify the Stripe-Signature header on the raw body, keep the webhook secret on the server, and ignore duplicate events before you grant access.
  43. 43GuideKeep secrets out of frontend codeWhat Next.js and Vite put in the browser bundle, which keys are safe there, and where Supabase, Firebase, and Stripe secret keys actually belong.
  44. 44GuideThe first hour after an API key leaksRevoke the leaked API key first. Then check logs for use, replace it with less privilege, and clean up git only after the old key is dead.