Ship your AI-built app without leaking data or keys. Practical security notes for people building with AI coding tools.https://vibelocked.com/en-ushttps://vibelocked.com/guides/client-side-auth-admin-page-security/https://vibelocked.com/guides/client-side-auth-admin-page-security/A JS role check, localStorage flag, or email gate only hides your admin page. Enforce roles on the server with Supabase RLS, Next.js, Firebase, or Clerk.Mon, 19 Oct 2026 00:00:00 GMTauthorizationaccess-controladminnextjssupabasefirebaseclerkrlshttps://vibelocked.com/guides/expo-react-native-api-keys-secrets/https://vibelocked.com/guides/expo-react-native-api-keys-secrets/EXPO_PUBLIC_ and .env values ship inside your app. Which keys are safe in a mobile bundle, and how to move OpenAI and secret keys to a server proxy.Mon, 19 Oct 2026 00:00:00 GMTexporeact-nativemobileapi-keyssecretsenv-varsopenaisupabasefirebasehttps://vibelocked.com/guides/login-brute-force-protection-supabase-clerk-firebase-authjs/https://vibelocked.com/guides/login-brute-force-protection-supabase-clerk-firebase-authjs/Rate limits, CAPTCHA, lockout, and MFA for Supabase, Clerk, Firebase, and Auth.js logins, plus generic errors and a safe way to test your own app.Mon, 19 Oct 2026 00:00:00 GMTauthbrute-forcecredential-stuffingrate-limitingsupabaseclerkfirebaseauthjsnextjshttps://vibelocked.com/guides/mcp-server-security-cursor-claude-code/https://vibelocked.com/guides/mcp-server-security-cursor-claude-code/Before you add an MCP server to Cursor, Claude Code, or VS Code: tool poisoning, prompt injection, rug pulls, leaked tokens, and settings that limit damage.Mon, 19 Oct 2026 00:00:00 GMTmcpai-coding-toolscursorclaude-codeprompt-injectionsupply-chainsecretshttps://vibelocked.com/guides/supabase-rls-infinite-recursion-policy-fix/https://vibelocked.com/guides/supabase-rls-infinite-recursion-policy-fix/Why Supabase RLS throws 42P17 infinite recursion, the safe private security definer fix, and the AI quick fixes that quietly open your data.Mon, 19 Oct 2026 00:00:00 GMTsupabaserlspostgressecurity-definererrorssecurityhttps://vibelocked.com/guides/supabase-security-advisor-warnings-fix/https://vibelocked.com/guides/supabase-security-advisor-warnings-fix/What each Supabase Security Advisor lint means, which ones are urgent, and the SQL fix: RLS disabled, mutable search_path, definer views, and more.Mon, 19 Oct 2026 00:00:00 GMTsupabaserlspostgressecurity-advisorsecurity-definerauthsecurityhttps://vibelocked.com/guides/firestore-security-rules-allow-read-write-if-true/https://vibelocked.com/guides/firestore-security-rules-allow-read-write-if-true/What Firebase test mode and if true rules really allow, how to check whether your Firestore or Storage is open to the public, and the rules to deploy instead.Fri, 16 Oct 2026 00:00:00 GMTfirebasefirestoresecurity-rulesfirebase-storageapp-checkhttps://vibelocked.com/guides/sql-injection-prisma-drizzle-supabase-nextjs/https://vibelocked.com/guides/sql-injection-prisma-drizzle-supabase-nextjs/Fix SQL injection in Prisma, Drizzle, and Supabase: tagged templates, never sql.raw with user input, and parameterize Postgres functions called via rpc.Fri, 16 Oct 2026 00:00:00 GMTsql-injectionprismadrizzlesupabasenextjssecurityhttps://vibelocked.com/guides/supabase-edge-functions-auth-verify-jwt/https://vibelocked.com/guides/supabase-edge-functions-auth-verify-jwt/Secure Supabase Edge Functions: what verify_jwt does not prove, getClaims vs getUser, secret key safety, signed webhooks, CORS, and rate limits.Fri, 16 Oct 2026 00:00:00 GMTsupabaseedge-functionsauthjwtdenosecurityhttps://vibelocked.com/guides/supabase-realtime-authorization/https://vibelocked.com/guides/supabase-realtime-authorization/Secure Supabase Realtime: private channels, RLS on realtime.messages for Broadcast and Presence, postgres_changes, and vibe-coded mistakes.Fri, 16 Oct 2026 00:00:00 GMTsupabaserealtimerlsauthorizationbroadcastpresencesecurityhttps://vibelocked.com/guides/supabase-realtime-broadcast-from-database/https://vibelocked.com/guides/supabase-realtime-broadcast-from-database/Harden Supabase Realtime broadcast from Postgres: realtime.send, broadcast_changes, private channels, payload leakage, and vibe-coded trigger mistakes.Fri, 16 Oct 2026 00:00:00 GMTsupabaserealtimebroadcastrlspostgressecuritytriggershttps://vibelocked.com/guides/supabase-views-security-definer-bypass-rls/https://vibelocked.com/guides/supabase-views-security-definer-bypass-rls/Fix Supabase views and SECURITY DEFINER functions that skip RLS: set security_invoker, pin search_path, revoke EXECUTE, and test as anon.Fri, 16 Oct 2026 00:00:00 GMTsupabaserlspostgresviewssecurity-definersecurityhttps://vibelocked.com/guides/test-supabase-rls-policies-ci/https://vibelocked.com/guides/test-supabase-rls-policies-ci/Test Supabase RLS with pgTAP and supabase test db: block anon and cross-tenant access, fail CI on tables without RLS, and run it all in GitHub Actions.Fri, 16 Oct 2026 00:00:00 GMTsupabaserlspostgrespgtaptestinggithub-actionssecurityhttps://vibelocked.com/guides/ai-hallucinated-packages-slopsquatting/https://vibelocked.com/guides/ai-hallucinated-packages-slopsquatting/AI coding tools sometimes suggest npm or PyPI packages that do not exist, and attackers register the names. How it works, and a quick check before you install.Thu, 15 Oct 2026 00:00:00 GMTsupply-chainnpmdependenciesai-coding-toolshttps://vibelocked.com/guides/authjs-auth-secret-nextauth/https://vibelocked.com/guides/authjs-auth-secret-nextauth/Auth.js needs AUTH_SECRET (NEXTAUTH_SECRET in older NextAuth) on the server only. What it encrypts, how to generate a strong value, and how to rotate it safely.Thu, 15 Oct 2026 00:00:00 GMTauthjsnextauthsecretsnextjshttps://vibelocked.com/guides/cors-misconfiguration-vibe-coded-apps/https://vibelocked.com/guides/cors-misconfiguration-vibe-coded-apps/AI tools often 'fix' CORS errors by allowing every origin or turning on credentials. What is dangerous in Next.js, Express, and Supabase, plus safe configs.Thu, 15 Oct 2026 00:00:00 GMTcorsnextjssupabaseexpressheadershttps://vibelocked.com/guides/csp-content-security-policy-vibe-coded-apps/https://vibelocked.com/guides/csp-content-security-policy-vibe-coded-apps/Where to set a CSP header on Next.js, Vercel, and static hosts, a starter policy, what breaks with Stripe, Clerk, and Supabase, and a safe Report-Only rollout.Thu, 15 Oct 2026 00:00:00 GMTcspheadersxssnextjsvercelhttps://vibelocked.com/guides/exposed-env-git-source-maps-deployed-app/https://vibelocked.com/guides/exposed-env-git-source-maps-deployed-app/How vibe-coded apps end up serving .env files, .git folders, and source maps, a five-minute check for your site, and fixes for Vercel, Netlify, and Cloudflare.Thu, 15 Oct 2026 00:00:00 GMTsecretsdeploymentsource-mapsenv-varsnextjsvitecloudflarehttps://vibelocked.com/guides/idor-broken-object-level-authorization-nextjs-supabase/https://vibelocked.com/guides/idor-broken-object-level-authorization-nextjs-supabase/Fix IDOR in Next.js Route Handlers and Supabase: get the user from a verified session, scope every query by owner, add RLS, and test with a second account.Thu, 15 Oct 2026 00:00:00 GMTidorauthorizationnextjssupabaserlshttps://vibelocked.com/guides/open-redirect-callbackurl-authjs-supabase-clerk/https://vibelocked.com/guides/open-redirect-callbackurl-authjs-supabase-clerk/AI-built login flows often redirect to any callbackUrl, redirectTo, or next value in the URL, sending users to phishing sites. How to allow-list redirects.Thu, 15 Oct 2026 00:00:00 GMTauthjsnextauthsupabaseclerkopen-redirectoauthhttps://vibelocked.com/guides/prompt-injection-ai-features-vibe-coded-apps/https://vibelocked.com/guides/prompt-injection-ai-features-vibe-coded-apps/If your app sends user text, files, or web pages to an LLM, someone can hijack it. How prompt injection hits chatbots, RAG, and agents, and how to limit it.Thu, 15 Oct 2026 00:00:00 GMTprompt-injectionai-apisopenaillmnextjssupabasehttps://vibelocked.com/guides/rate-limit-ai-api-routes-nextjs-supabase/https://vibelocked.com/guides/rate-limit-ai-api-routes-nextjs-supabase/Rate limiting for OpenAI and other LLM routes: per-user and per-IP limits with Upstash, daily token budgets, Supabase Edge Functions, and provider spend caps.Thu, 15 Oct 2026 00:00:00 GMTrate-limitingopenaiai-apisnextjssupabasebillinghttps://vibelocked.com/guides/secure-file-uploads-nextjs-supabase-vercel-blob/https://vibelocked.com/guides/secure-file-uploads-nextjs-supabase-vercel-blob/Stop uploads that trust file.type, skip auth, or land in public/. Use direct-to-storage uploads, MIME allow-lists, safe filenames, and private storage buckets.Thu, 15 Oct 2026 00:00:00 GMTnextjssupabaseverceluploadsstoragehttps://vibelocked.com/guides/vercel-cron-jobs-cron-secret/https://vibelocked.com/guides/vercel-cron-jobs-cron-secret/AI-generated apps often leave /api/cron routes open. How Vercel sends CRON_SECRET as a Bearer token, how to return 401 to other callers, and fail-open bugs.Thu, 15 Oct 2026 00:00:00 GMTvercelnextjscronenv-varsapi-routeshttps://vibelocked.com/guides/xss-dangerouslysetinnerhtml-markdown-ai-output-react-nextjs/https://vibelocked.com/guides/xss-dangerouslysetinnerhtml-markdown-ai-output-react-nextjs/React escapes JSX text, but dangerouslySetInnerHTML, rehype-raw, and AI chat output can still run attacker scripts. Sanitize with DOMPurify and allow-list URLs.Thu, 15 Oct 2026 00:00:00 GMTxssreactnextjsmarkdownaisanitizationhttps://vibelocked.com/checklists/ship-checklist-for-a-vibe-coded-app/https://vibelocked.com/checklists/ship-checklist-for-a-vibe-coded-app/The ordered checks to run before you share the URL of an app built with Lovable, Bolt, Cursor, Supabase, or Firebase, from leaked keys to payments.Wed, 14 Oct 2026 00:00:00 GMTlaunchchecklistsupabasefirebasenextjshttps://vibelocked.com/guides/clerk-publishable-key-vs-secret-key/https://vibelocked.com/guides/clerk-publishable-key-vs-secret-key/Your Clerk pk_ key is fine in frontend code; your sk_ key and whsec_ secret are not. The right env var names for Next.js and Vite, and how to rotate a leak.Wed, 14 Oct 2026 00:00:00 GMTclerkapi-keysnextjshttps://vibelocked.com/guides/firebase-api-key-public-app-check/https://vibelocked.com/guides/firebase-api-key-public-app-check/Why the Firebase web API key is public by design, the one restriction that makes it dangerous, and how Security Rules and App Check actually protect your data.Wed, 14 Oct 2026 00:00:00 GMTfirebaseapi-keysapp-checkhttps://vibelocked.com/guides/nextjs-middleware-auth-bypass-cve-2025-29927/https://vibelocked.com/guides/nextjs-middleware-auth-bypass-cve-2025-29927/CVE-2025-29927 let one header skip Next.js middleware auth checks. Affected versions, the patched releases, who is safe, and how to fix your app.Wed, 14 Oct 2026 00:00:00 GMTnextjsauthmiddlewarehttps://vibelocked.com/guides/remove-api-key-from-github-history/https://vibelocked.com/guides/remove-api-key-from-github-history/Rotate the key first, then purge it from every commit with git filter-repo or BFG, force-push carefully, and clean up clones, forks, and GitHub's cached views.Wed, 14 Oct 2026 00:00:00 GMTsecretsgithubgitincident-responsehttps://vibelocked.com/guides/stripe-success-page-paywall-bypass/https://vibelocked.com/guides/stripe-success-page-paywall-bypass/If your app grants paid access when someone lands on ?success=true, anyone can type that URL. Unlock features only from verified Stripe data, using webhooks.Wed, 14 Oct 2026 00:00:00 GMTstripepaymentspaywallhttps://vibelocked.com/guides/supabase-auth-security-settings/https://vibelocked.com/guides/supabase-auth-security-settings/Supabase Auth settings AI-built apps leave on defaults: Site URL, redirects, email confirmation, password rules, leaked password checks, and reauthentication.Wed, 14 Oct 2026 00:00:00 GMTsupabaseauthhttps://vibelocked.com/guides/vercel-preview-deployments-env-vars/https://vibelocked.com/guides/vercel-preview-deployments-env-vars/Preview URLs can expose unfinished features and production data. Set Deployment Protection, split Preview and Production env vars, and use Secret variables.Wed, 14 Oct 2026 00:00:00 GMTvercelenv-varsdeploymentshttps://vibelocked.com/guides/check-if-api-key-leaked-on-github/https://vibelocked.com/guides/check-if-api-key-leaked-on-github/Search your repo, your git history, and GitHub's own alerts for exposed API keys, then know what to do when you find one, starting with rotation.Tue, 13 Oct 2026 00:00:00 GMTsecretsgithubleakshttps://vibelocked.com/guides/environment-variables-cursor-bolt-lovable/https://vibelocked.com/guides/environment-variables-cursor-bolt-lovable/Which env vars end up in the browser, how to keep .env files away from AI agents and git, and where server secrets belong in Cursor, Bolt.new, and Lovable.Tue, 13 Oct 2026 00:00:00 GMTsecretsenv-varscursorboltlovablehttps://vibelocked.com/guides/nextjs-server-actions-security/https://vibelocked.com/guides/nextjs-server-actions-security/Server Actions are public HTTP endpoints. How to add authentication, authorization, and input validation so AI generated actions are safe to ship.Tue, 13 Oct 2026 00:00:00 GMTnextjsserver-actionsauthhttps://vibelocked.com/guides/protect-openai-api-route-from-abuse/https://vibelocked.com/guides/protect-openai-api-route-from-abuse/Your AI API route is a free proxy to your OpenAI or Anthropic account until you lock it down. Auth, rate limits, input caps, and spend limits.Tue, 13 Oct 2026 00:00:00 GMTopenaiai-apisrate-limitingbillinghttps://vibelocked.com/guides/replit-secrets-guide/https://vibelocked.com/guides/replit-secrets-guide/How to store API keys in Replit Secrets, read them safely in code, and avoid leaking them through public Repls, frontends, and logs.Tue, 13 Oct 2026 00:00:00 GMTreplitsecretshttps://vibelocked.com/guides/security-review-prompt-for-ai-coding-tools/https://vibelocked.com/guides/security-review-prompt-for-ai-coding-tools/A copy-paste prompt that asks an AI coding tool for a security review, plus how to read the answer without trusting it blindly.Tue, 13 Oct 2026 00:00:00 GMTcursorpromptreviewhttps://vibelocked.com/guides/supabase-anon-key-vs-service-role-key/https://vibelocked.com/guides/supabase-anon-key-vs-service-role-key/Which Supabase key is safe in the browser, which one bypasses Row Level Security, and where each belongs in a Lovable, Bolt, or Next.js app.Tue, 13 Oct 2026 00:00:00 GMTsupabasesecretsrlshttps://vibelocked.com/guides/supabase-storage-bucket-security/https://vibelocked.com/guides/supabase-storage-bucket-security/Stop strangers from listing, downloading, or overwriting files in Supabase Storage, with policies for per-user folders and signed URLs.Tue, 13 Oct 2026 00:00:00 GMTsupabasestoragerlshttps://vibelocked.com/guides/common-vibe-coded-app-vulnerabilities/https://vibelocked.com/guides/common-vibe-coded-app-vulnerabilities/How IDOR, exposed service role keys, and missing auth on API routes show up in apps built with AI coding tools, and how to fix each one.Mon, 12 Oct 2026 00:00:00 GMTidorauthorizationnextjssupabasehttps://vibelocked.com/checklists/lovable-bolt-pre-launch-security-checklist/https://vibelocked.com/checklists/lovable-bolt-pre-launch-security-checklist/A pre-launch security pass for Lovable, Bolt, v0, Cursor, and Replit apps: exposed keys, database rules, auth, storage, and payments before you share the URL.Sun, 11 Oct 2026 00:00:00 GMTlovableboltcursorreplitv0https://vibelocked.com/guides/securing-stripe-webhooks/https://vibelocked.com/guides/securing-stripe-webhooks/Verify the Stripe-Signature header on the raw body, keep the webhook secret on the server, and ignore duplicate events before you grant access.Sat, 10 Oct 2026 00:00:00 GMTstripewebhooksnextjshttps://vibelocked.com/guides/keep-secrets-out-of-frontend-code/https://vibelocked.com/guides/keep-secrets-out-of-frontend-code/What Next.js and Vite put in the browser bundle, which keys are safe there, and where Supabase, Firebase, and Stripe secret keys actually belong.Fri, 09 Oct 2026 00:00:00 GMTnextjsvitesecretssupabasehttps://vibelocked.com/guides/first-hour-after-an-api-key-leaks/https://vibelocked.com/guides/first-hour-after-an-api-key-leaks/Revoke the leaked API key first. Then check logs for use, replace it with less privilege, and clean up git only after the old key is dead.Thu, 08 Oct 2026 00:00:00 GMTsecretsgithubincident-responsehttps://vibelocked.com/checklists/firebase-security-rules-checklist/https://vibelocked.com/checklists/firebase-security-rules-checklist/Replace test mode, stop open Firebase security rules, and check ownership, queries, and custom claims before you ship Firestore.Wed, 07 Oct 2026 00:00:00 GMTfirebasefirestoresecurity-ruleshttps://vibelocked.com/checklists/supabase-rls-security-checklist/https://vibelocked.com/checklists/supabase-rls-security-checklist/Enable RLS, fix table grants, write one policy per operation, and test as the anon role before you ship a Supabase app built with Lovable, Bolt, or Cursor.Tue, 06 Oct 2026 00:00:00 GMTsupabaserlspostgres