Security guides for vibe-coded apps
Plain-English breakdowns of the issues that show up most often in apps built with Cursor, Bolt, Lovable, and v0 — written for founders, not security engineers.
Looking for research and statistics instead? Visit the blog.
Supabase RLS: the #1 security bug in vibe-coded apps
Your anon key being public is fine. Missing Row Level Security behind it is not. How to check, and how to fix it.
Read the guide API KeysHow to find and fix exposed API keys in your AI-built app
Not every key in your JavaScript bundle is a leak. Exactly which keys are safe, which are critical, and how to fix each.
Read the guide ChecklistThe vibe-coding security checklist
Every issue that shows up most often in Cursor, Bolt, Lovable, and v0 apps — in the order they tend to matter most.
Read the guide IDORIDOR: the sequential-ID bug in Cursor, Bolt & Lovable apps
If your URLs look like /orders/1042, changing the number can load someone else's data. How to spot it and fix it, with or without UUIDs.
Read the guide PaymentsWebhook signature verification: the free-money bug
If your payment webhook trusts the request body without checking who sent it, anyone can fake a "payment succeeded" event and get a free plan.
Read the guide How It WorksAll 53 StackSecured scan engines, explained
What each engine actually checks — from XSS/SQLi probes gated behind domain verification, to the SEO, AEO, and GEO signals in every free scan.
Read the guide