GUIDE
Guides: check your app before launch
If you build an app with AI tools, you often only see after launch what visitors can see from the outside. These guides explain the most common spots in plain words. You start the free check on the home page.
Security
- GUIDE · SECURITY
Lovable app security: what to check before launch
Lovable ships its own security checks. You should still check what visitors can see from the outside before you promote the app.
2 min readRead - GUIDE · SECURITY
Supabase anon key exposed: is it a problem?
A public publishable or anon key is normal. A secret or service_role key in the frontend is an emergency.
3 min readRead - GUIDE · SECURITY
API key in frontend code: how to find and remove it
Anything that runs in the browser can be read by anyone. A secret key belongs on the server.
3 min readRead - GUIDE · SECURITY
Supabase: how to enable Row Level Security properly
A table in an exposed schema without RLS is readable and writable by any role with a grant. Enable RLS per table and add one policy per action.
4 min readRead - GUIDE · SECURITY
Securing a Bolt app: the essentials before launch
Keys belong in the backend, database access needs rules, and you check headers and legal pages before launch. The steps apply to any app, including one built with Bolt.
1 min readRead - GUIDE · SECURITY
Exposed .env and .git: how to check and fix it
If these files sit in the published folder, anyone may be able to fetch them. Check the address, remove the files from the served folder and rotate the keys.
3 min readRead - GUIDE · SECURITY
Open Firebase rules: how to lock down Firestore and Storage
The rule allow read, write: if true is meant for development only. With direct access from the client, the rules are the only layer of protection.
3 min readRead - GUIDE · SECURITY
Setting security headers on Vercel and Netlify
On Vercel you set headers in vercel.json, on Netlify in _headers or netlify.toml. Test a Content-Security-Policy in report-only mode first.
3 min readRead - GUIDE · SECURITY
Lovable data leak: check your Supabase data
Is your Supabase data readable without login? Crissy Field and Handelsblatt showed how often access rules on Lovable apps are missing or too broad. Here is how to check and fix it.
3 min readRead
Privacy and legal notices
- GUIDE · PRIVACY AND LEGAL NOTICES
Privacy policy and legal notice for your app (GDPR, Germany)
If you offer a website or app to people in the EU and process personal data, the GDPR requires you to tell them how. Germany adds an imprint (legal notice) duty.
4 min readRead - GUIDE · PRIVACY AND LEGAL NOTICES
Google Fonts, analytics and tracking before consent (GDPR/ePrivacy)
Fonts and tracking scripts send data to third parties when they load. Whether that needs consent depends on the case. Hosting fonts yourself avoids the transfer. For scripts, it depends on where they send data.
3 min readRead