[{"data":1,"prerenderedAt":654},["ShallowReactive",2],{"blog-en-vibe-coding-security-scanner":3,"blog-index-en":411},{"id":4,"title":5,"body":6,"category":364,"cover":365,"coverAlt":366,"description":367,"draft":368,"extension":369,"faq":370,"image":388,"keywords":389,"meta":399,"navigation":400,"ogTitle":401,"path":402,"published":403,"seo":404,"stem":405,"tldr":406,"updated":403,"__hash__":410},"blog_en\u002Fblog\u002Fvibe-coding-security-scanner.md","Vibe coding security scanner: what a URL scan misses",{"type":7,"value":8,"toc":352},"minimark",[9,13,21,24,29,32,35,38,41,45,48,126,132,135,144,148,151,157,163,169,175,178,182,185,188,193,196,209,213,216,277,284,287,291,294,297,300,310,314,336,344],[10,11,12],"p",{},"You paste your app's address into a scanner, wait about twenty seconds, and a\nletter comes back. A, maybe C. Then the question that actually matters arrives:\ndoes this mean my app is fine?",[10,14,15,16,20],{},"Here is the part most tools in this category leave you to work out on your own.\n",[17,18,19],"strong",{},"A vibe coding security scanner reads your app from the street."," It sees what\nany visitor's browser sees, which turns out to be a great deal, and it stops at\nyour front door. Whatever your server does in private stays private from the\nscanner too.",[10,22,23],{},"Knowing where that line falls is what makes a scan worth running. An A tells you\nthe doors facing the street were shut when we looked, and it says nothing at all\nabout the room behind them.",[25,26,28],"h2",{"id":27},"what-is-a-vibe-coding-security-scanner","What is a vibe coding security scanner?",[10,30,31],{},"A tool that loads your live app the way a visitor would, then reads what came\nback.",[10,33,34],{},"You hand it a URL. It does not ask for your source code, your repository, your\ndatabase password or an account on the builder you used. It fetches your page,\nlets the JavaScript run so it can see the code your app actually ships, reads\nthe headers that came with the response, looks at your certificate, and asks\nyour database and your file storage a few questions any stranger could ask.",[10,36,37],{},"Then it writes down what answered. That is the whole shape of it, and it is why\nthis takes twenty seconds instead of a week.",[10,39,40],{},"The category exists because apps built with Lovable, Bolt, v0, Cursor, Replit,\nWindsurf and Base44 tend to go wrong in the same small number of places, and\nalmost all of those places are visible from outside. A secret key in the bundle.\nA table that answers a stranger. A storage bucket that lists its own contents.\nNobody needs your source to find any of them, because your app hands them to\nevery visitor by design.",[25,42,44],{"id":43},"what-a-scan-actually-reads","What a scan actually reads",[10,46,47],{},"Five surfaces, and your own visitors download four of them without noticing.",[49,50,51,67],"table",{},[52,53,54],"thead",{},[55,56,57,61,64],"tr",{},[58,59,60],"th",{},"What it reads",[58,62,63],{},"Where that comes from",[58,65,66],{},"What it catches",[68,69,70,82,93,104,115],"tbody",{},[55,71,72,76,79],{},[73,74,75],"td",{},"Your JavaScript bundle",[73,77,78],{},"The files a browser downloads to run your app",[73,80,81],{},"Keys shipped to the browser, the API paths your app calls, table names it uses",[55,83,84,87,90],{},[73,85,86],{},"Your response headers",[73,88,89],{},"Sent back with every page your host serves",[73,91,92],{},"Missing browser protections, a rule that answers requests from any website",[55,94,95,98,101],{},[73,96,97],{},"Your database's answers",[73,99,100],{},"The same project API your app itself calls",[73,102,103],{},"A table handing rows to a request with nobody signed in",[55,105,106,109,112],{},[73,107,108],{},"Your storage buckets",[73,110,111],{},"The same public storage API your app uploads through",[73,113,114],{},"A bucket that will list its own files for a stranger",[55,116,117,120,123],{},[73,118,119],{},"Your certificate and domain",[73,121,122],{},"The TLS handshake, and the public registry record",[73,124,125],{},"A certificate about to expire, a domain about to lapse",[127,128],"diagram",{"alt":129,"caption":130,"src":131},"A scanner marker on the left reaches five panes through solid accent lines. A vertical rule crosses the picture, and four more panes sit behind it drawn as dashed outlines, each with its line stopping at the rule and taking a cross.","Five surfaces arrive in a browser, so a scan can read them. The four behind the rule never leave your server, so nothing outside can.","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fwhere-the-scan-stops-1600x820.png",[10,133,134],{},"The bundle is the one that surprises people. Your app's code has to arrive in the\nbrowser before it can run there, so every key in it arrives too, along with the\nAPI paths it calls and often the names of the tables it reads. A scanner presses\nthe same F12 a curious visitor would press. It is only faster, and it reads\nevery file instead of the first one.",[10,136,137,138,143],{},"The database question is the one people expect to be invasive, and it is the\ntamest thing on the list. To find out whether a table is readable by strangers,\nours asks the API for a count of the rows and reads the number off a response\nheader. A count above zero means those rows are reachable. No row is ever\nfetched, and the key it asks with is the publishable one already sitting in your\nbundle, which\n",[139,140,142],"a",{"href":141},"\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend","is supposed to be there",".",[25,145,147],{"id":146},"the-four-things-a-url-scan-cannot-see","The four things a URL scan cannot see",[10,149,150],{},"Everything that happens on your server, because none of it is ever sent to a\nbrowser.",[10,152,153,156],{},[17,154,155],{},"Your server code."," Edge functions, API routes, database functions, anything\nrunning inside Supabase or on your host. A scanner can call an endpoint and read\nwhat comes back. It cannot read the code that produced it, so a mistake that\nonly appears on certain inputs stays invisible.",[10,158,159,162],{},[17,160,161],{},"Your environment variables."," The keys you kept on the server, which is\nexactly where they belong. A scan can tell you it did not find a secret in your\nbundle. It cannot confirm that the secret is stored properly, because it never\nsees the place you stored it.",[10,164,165,168],{},[17,166,167],{},"Your version history."," A key you committed in March and removed in April is\ngone from your app and still sitting in your repository. Anyone who can see that\nrepository can still read it, and no amount of looking at your live site will\nturn it up.",[10,170,171,174],{},[17,172,173],{},"Your app's own logic."," Whether one signed-in user can open another user's\norder by changing a number in the address. Whether a form will accept a price\nthe browser sent it. These are decisions your app makes about what to allow, and\ncatching them means signing in and trying things, which is a penetration test.",[10,176,177],{},"There is a fifth limit that belongs to us rather than to the category, and it is\nworth knowing before you read one of our reports. Supabase no longer serves the\nlist of tables in a project to a publishable key, so a scanner has no way to ask\nwhat your tables are called. Ours works from three sources instead: the project\nindex on older projects where it still answers, the table names it finds in your\nown bundle, and a list of twenty-six names that vibe-coded apps commonly use. An\nopen table with an unusual name that never appears in your frontend code is one\nwe will not reach. Supabase's own advisor will, which is the comparison two\nsections down.",[25,179,181],{"id":180},"does-a-clean-scan-mean-my-app-is-secure","Does a clean scan mean my app is secure?",[10,183,184],{},"No. It means every question the scan could ask from outside came back clean, and\nthat is a smaller sentence than it sounds.",[10,186,187],{},"Part of the reason is the four blind spots above. The other part is that a check\ncan end three ways and only one of them is a pass. A check finds something. A\ncheck asks and gets a clear no. Or a check gets no answer at all, because the\nrequest timed out, the host refused it, or the page never finished loading.",[127,189],{"alt":190,"caption":191,"src":192},"A report pane with five rows. Three carry a green tick, one carries a red cross, and the last has a dashed rule where a mark would be and no verdict at all.","The third ending is the one to look for. A check that got no answer is drawn as no answer, because a tick there is a promise about a question nobody managed to ask.","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fthree-endings-1600x760.png",[10,194,195],{},"That third ending is the one that decides whether a report can be trusted, and\nit is the easiest to quietly round up into a tick. Ours prints \"Couldn't check\"\non the line and leaves your grade alone. A false tick is the most damaging thing\nthis scanner could put on a screen, because you would act on it.",[10,197,198,199,203,204,208],{},"The same honesty is what makes our own published numbers less alarming than they\nfirst look. Between 12 and 14 August 2026 we ran these checks over\n",[139,200,202],{"href":201},"\u002Fresearch\u002Fvibe-coded-app-security-2026","30,998 live vibe-coded apps",", and 99% of\nthem came back with at least one finding. Nearly all of that is a single line:\nbrowser safety headers the hosting platform never sets, which most owners on a\nbuilder subdomain\n",[139,205,207],{"href":206},"\u002Fblog\u002Fmissing-security-headers","cannot switch on themselves",". Counting it is\ncorrect. Reading 99% as \"almost every app is in danger\" is not.",[25,210,212],{"id":211},"url-scan-repo-scan-or-supabases-own-advisor","URL scan, repo scan, or Supabase's own advisor?",[10,214,215],{},"They read three different things, so the useful question is which one can see\nthe problem you have.",[49,217,218,233],{},[52,219,220],{},[55,221,222,225,227,230],{},[58,223,224],{},"Kind",[58,226,60],{},[58,228,229],{},"What it needs from you",[58,231,232],{},"Where it is blind",[68,234,235,249,263],{},[55,236,237,240,243,246],{},[73,238,239],{},"URL scanner",[73,241,242],{},"Your live app, from outside",[73,244,245],{},"A URL",[73,247,248],{},"Anything your server keeps to itself",[55,250,251,254,257,260],{},[73,252,253],{},"Repository scanner",[73,255,256],{},"Your source code and its history",[73,258,259],{},"Access to your repo",[73,261,262],{},"Whether that code is deployed, and what your rules do live",[55,264,265,268,271,274],{},[73,266,267],{},"Supabase Security Advisor",[73,269,270],{},"That project's own configuration",[73,272,273],{},"Your Supabase account",[73,275,276],{},"Everything outside the project: bundle, headers, other vendors",[10,278,279,280,143],{},"They overlap far less than the names suggest. Supabase's advisor scans your\nproject and reports configuration problems, including tables with row-level\nsecurity misconfigured. A URL scan reads the consequence, which is whether those\nrows are reaching strangers right now. The two come apart more often than you\nwould expect, because\n",[139,281,283],{"href":282},"\u002Fblog\u002Fsupabase-rls-on-but-table-still-public","switching the setting on is not the same as being protected",[10,285,286],{},"A repository scanner is the only one of the three that can find the key you\ndeleted last month. It is also the only one that cannot tell you whether the\ncode it just read is the code you have deployed.",[25,288,290],{"id":289},"how-to-read-the-grade","How to read the grade",[10,292,293],{},"The letter is capped by the worst single finding on the report, so a good score\nnever rescues a serious one.",[10,295,296],{},"Every scan starts at 100. A critical finding costs 40 points, a high 15, a\nmedium 5, a low 1. Then a ceiling sits over the arithmetic: one critical caps\nthe grade at D, two cap it at F, and one high finding caps it at C. An otherwise\ntidy app with a single open table comes out a D, which is the intended\nbehaviour.",[10,298,299],{},"Things you got right appear on the report and cost you nothing. Your publishable\nSupabase key sitting in your bundle is listed as correct, because that is what\nit is for, and painting it red is how a tool teaches you to ignore red.",[301,302,304],"callout",{"type":303},"warn",[10,305,306,309],{},[17,307,308],{},"A grade describes the app that was live when you asked."," Row-level security\ngets switched off to make a page load, a server key gets pasted into the\nfrontend so a feature ships tonight, a bucket gets opened for one upload and\nstays open. None of those announce themselves, and each is enough to move a\ngrade from A to F between one Tuesday and the next.",[25,311,313],{"id":312},"what-to-do-with-a-scan-result","What to do with a scan result",[315,316,317],"key-takeaways",{},[318,319,320,324,327,330,333],"ul",{},[321,322,323],"li",{},"Read the lines that say \"Couldn't check\" first. Those are the questions still open, and they are not passes.",[321,325,326],{},"Work in severity order. A critical finding means your data is reachable today; a missing header is a setting nobody has switched on.",[321,328,329],{},"Handle the inside separately: keep secret keys on the server, search your own version history for keys you deleted, and sign in as a test user to see what they can reach.",[321,331,332],{},"Scan again after a deploy, and after anyone touches a database rule. That is the change nothing tells you about.",[321,334,335],{},"If your app takes payments or holds health records, book a penetration test eventually. An automated external check is not an audit, and no absence of findings is a guarantee.",[10,337,338,339,343],{},"Our own ",[139,340,342],{"href":341},"\u002Fsecurity-scanner","free website security scanner"," runs nine read-only\nchecks on any live URL in about twenty seconds, with no account. It reads, it\nnever writes, and it never signs in.",[10,345,346,347,351],{},"If you would rather go through it by hand first, the\n",[139,348,350],{"href":349},"\u002Fchecklist","10-minute security checklist"," covers the same ground in the order\nworth doing it in.",{"title":353,"searchDepth":354,"depth":354,"links":355},"",3,[356,358,359,360,361,362,363],{"id":27,"depth":357,"text":28},2,{"id":43,"depth":357,"text":44},{"id":146,"depth":357,"text":147},{"id":180,"depth":357,"text":181},{"id":211,"depth":357,"text":212},{"id":289,"depth":357,"text":290},{"id":312,"depth":357,"text":313},"Security basics","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcover-1200x630.png","One lit pane of an app seen straight on, with two more panes receding behind it into shadow, unreadable.","A vibe coding security scanner reads your live app from outside. Here is what that covers, the four things it cannot see, and how to read the result.",false,"md",[371,373,376,379,382,385],{"q":28,"a":372},"A tool that loads your live app the way a visitor would and reads what came back: the JavaScript your app ships to the browser, the headers your host sends with it, the certificate, and the answers your database and file storage give to a request from a stranger. It needs a URL and nothing else. It reports what it found on the public surface of your app, which is where apps built with AI builders most often go wrong.",{"q":374,"a":375},"Is it safe to scan my own app?","Yes, when the scanner only reads. Ours makes the same kind of requests one ordinary visitor makes, never signs in, never writes, creates or deletes anything, and never downloads your users' data. To test whether a database table is readable it asks for a count of the rows and reads the number, without fetching a single row. The traffic is a handful of requests, which is less than one person browsing your site for a minute.",{"q":377,"a":378},"Does a scan need my source code or my database password?","No. A URL scanner works entirely from outside, so there is nothing to connect and no credentials to hand over. That is also its limit: it can only see what your app already shows every visitor. A tool that reads your repository or connects to your database account sees different things, and the article above sets the three side by side.",{"q":380,"a":381},"Does it work with Lovable, Bolt, Cursor, Replit, v0, Windsurf and Base44?","Yes, and with anything else that puts a live site on the internet, because the scan looks at what is deployed rather than at what wrote it. The builder matters for the fix rather than for the check: the repair for an open table is a different set of clicks in Lovable than in Replit, which is why the fix text names your builder.",{"q":383,"a":384},"What does a security scanner not check?","Anything that stays on your server. Your server code and database functions, the environment variables you kept out of the browser, the key you committed and later deleted from your repository, and bugs in your own logic such as one signed-in user being able to load another user's order by changing a number in the address. Finding that last group means signing in and trying things, which is a penetration test rather than a scan.",{"q":386,"a":387},"Is a vibe coding security scanner free?","Ours is, for the scan itself: you get the grade, the score and the counts on screen in about 20 seconds with no account, and the detailed findings and fixes after you give an email address. Paid plans exist for what a one-off scan cannot do, which is notice when something changes next month. A grade is true the second you take it.","\u002Fblog\u002Fvibe-coding-security-scanner\u002Fcard-800x500.png",[390,391,392,393,394,395,396,342,397,398],"vibe coding security scanner","vibe code scanner","AI app security scanner","security scanner for AI-generated apps","scan my Lovable app for vulnerabilities","Bolt app security scan","Replit app security scanner","check my app for exposed API keys","is my vibe coded app secure",{},true,"What a vibe coding security scanner misses","\u002Fblog\u002Fvibe-coding-security-scanner","2026-09-05",{"title":5,"description":367},"blog\u002Fvibe-coding-security-scanner",[407,408,409],"A vibe coding security scanner reads what your visitors' browsers already download: your bundle, your headers, your certificate, and the answers your database gives a stranger.","That covers the whole class of mistakes AI builders make most often. It covers nothing that happens on your server.","A clean result means every question the scan could ask from outside came back clean. Treat it as one fewer thing to worry about.","JRMaUmne7jkMBmfBbUHb4MDOnZN3Ys3yREhc2NGR9hM",[412,419,425,431,437,443,449,455,461,467,473,479,485,491,497,503,509,515,521,522,527,533,539,545,551,557,563,569,575,581,587,593,599,605,611,617,622,628,634,639,644,650],{"path":413,"title":414,"description":415,"published":416,"category":417,"image":418,"draft":368},"\u002Fblog\u002Fsupabase-backup-auth-users","Why your Supabase dump has no users in it","Run supabase db dump on its own and you get the shape of your database and none of its rows, with the auth schema your users live in left out entirely.","2026-09-23","Backups","\u002Fblog\u002Fsupabase-backup-auth-users\u002Fcard-800x500.png",{"path":420,"title":421,"description":422,"published":423,"category":364,"image":424,"draft":368},"\u002Fblog\u002Fdomain-and-certificate-expiry","Domain expired, website down: what actually happens next","Your domain expired and your website is down. Here is the clock you are on, why a lapsed certificate is the easier of the two, and how to check both.","2026-09-22","\u002Fblog\u002Fdomain-and-certificate-expiry\u002Fcard-800x500.png",{"path":426,"title":427,"description":428,"published":429,"category":364,"image":430,"draft":368},"\u002Fblog\u002Fis-lovable-safe","Is Lovable safe? What 18,554 live Lovable apps showed","Is Lovable safe? We ran nine checks on 18,554 live Lovable apps. The platform was the cleanest of five builders. Every finding was inside the app itself.","2026-09-21","\u002Fblog\u002Fis-lovable-safe\u002Fcard-800x500.png",{"path":432,"title":433,"description":434,"published":435,"category":364,"image":436,"draft":368},"\u002Fblog\u002Fvibe-coded-app-security-checklist","The vibe coding security checklist, in nine checks","A vibe coding security checklist with nine items, each one something anyone can verify about your live app from outside, and each with a one-line test.","2026-09-20","\u002Fblog\u002Fvibe-coded-app-security-checklist\u002Fcard-800x500.png",{"path":438,"title":439,"description":440,"published":441,"category":364,"image":442,"draft":368},"\u002Fblog\u002Fstripe-secret-key-in-frontend","A Stripe secret key exposed in your frontend can move money","A Stripe secret key exposed in your frontend can refund, charge and read every customer record you hold. Your pk_live_ key is meant to be there.","2026-09-19","\u002Fblog\u002Fstripe-secret-key-in-frontend\u002Fcard-800x500.png",{"path":444,"title":445,"description":446,"published":447,"category":364,"image":448,"draft":368},"\u002Fblog\u002Fvite-and-next-public-env-vars","Vite env variables exposed: VITE_ and NEXT_PUBLIC_ mean publish this","Vite env variables exposed in your app did what the prefix asked. VITE_ and NEXT_PUBLIC_ mean publish this, and the AI that added one never knew the cost.","2026-09-18","\u002Fblog\u002Fvite-and-next-public-env-vars\u002Fcard-800x500.png",{"path":450,"title":451,"description":452,"published":453,"category":364,"image":454,"draft":368},"\u002Fblog\u002Fbase44-source-maps","Base44 security: what a scan flags, and what is yours to fix","Base44 security on 5,438 scanned apps: three findings on nearly every one are the platform's, the source map is Base44's badge, and what is yours is short.","2026-09-17","\u002Fblog\u002Fbase44-source-maps\u002Fcard-800x500.png",{"path":456,"title":457,"description":458,"published":459,"category":364,"image":460,"draft":368},"\u002Fblog\u002Fis-cursor-ai-safe","Is Cursor AI safe? The editor, the code, and the app you shipped","Is Cursor AI safe? Three questions in one search: what Cursor keeps, what the code it writes gets wrong, and whether the app you shipped is open.","2026-09-16","\u002Fblog\u002Fis-cursor-ai-safe\u002Fcard-800x500.png",{"path":462,"title":463,"description":464,"published":465,"category":364,"image":466,"draft":368},"\u002Fblog\u002Fis-replit-safe","Is Replit safe? What we found in 3,042 live Replit apps","Is Replit safe? We ran nine external checks on 3,042 live Replit apps. The host was not where the findings were. The app each owner published was.","2026-09-15","\u002Fblog\u002Fis-replit-safe\u002Fcard-800x500.png",{"path":468,"title":469,"description":470,"published":471,"category":417,"image":472,"draft":368},"\u002Fblog\u002Fsupabase-storage-backup","Supabase storage backup: why your database copy has no files","A Supabase storage backup is a separate job. Database backups keep the list of your files and none of the files, so a restore leaves every upload broken.","2026-09-14","\u002Fblog\u002Fsupabase-storage-backup\u002Fcard-800x500.png",{"path":474,"title":475,"description":476,"published":477,"category":417,"image":478,"draft":368},"\u002Fblog\u002Fsupabase-point-in-time-recovery","Supabase point-in-time recovery: what it costs, what it misses","Supabase point-in-time recovery rewinds your database to any second in the last week. It costs $100 a month on top of Pro, and it covers your database only.","2026-09-13","\u002Fblog\u002Fsupabase-point-in-time-recovery\u002Fcard-800x500.png",{"path":480,"title":481,"description":482,"published":483,"category":417,"image":484,"draft":368},"\u002Fblog\u002Fsupabase-project-paused-recover","Supabase project paused? Your data is still there","Supabase paused your project after a week of inactivity. Nothing is deleted, Restore sits beside the project name, and you have a year before that changes.","2026-09-12","\u002Fblog\u002Fsupabase-project-paused-recover\u002Fcard-800x500.png",{"path":486,"title":487,"description":488,"published":489,"category":364,"image":490,"draft":368},"\u002Fblog\u002Fsafest-ai-app-builder","Which AI app builder is safest? We scanned 30,998 apps","Which AI app builder is safest? We scanned 30,998 live apps from Lovable, Base44, Replit, v0 and Bolt. The builder is not what decides your grade.","2026-09-11","\u002Fblog\u002Fsafest-ai-app-builder\u002Fcard-800x500.png",{"path":492,"title":493,"description":494,"published":495,"category":364,"image":496,"draft":368},"\u002Fblog\u002Fenable-rls-on-every-supabase-table","Enable Row Level Security on every Supabase table, then prove it","Enabling Row Level Security in Supabase with no policy locks a table completely. A policy without the setting does nothing. Here is the SQL, and the test.","2026-09-10","\u002Fblog\u002Fenable-rls-on-every-supabase-table\u002Fcard-800x500.png",{"path":498,"title":499,"description":500,"published":501,"category":364,"image":502,"draft":368},"\u002Fblog\u002Fsupabase-rls-disabled-in-public","Supabase \"RLS disabled in public\": what the warning misses","Supabase reports \"RLS disabled in public\" as an error. It says nothing about the read policy that leaves your table just as open to strangers.","2026-09-09","\u002Fblog\u002Fsupabase-rls-disabled-in-public\u002Fcard-800x500.png",{"path":504,"title":505,"description":506,"published":507,"category":364,"image":508,"draft":368},"\u002Fblog\u002Frotate-supabase-service-role-key","How to rotate a leaked Supabase service_role key","Supabase says fix the leak first. Other guides say rotate now. Which is right depends on where your service_role key leaked.","2026-09-08","\u002Fblog\u002Frotate-supabase-service-role-key\u002Fcard-800x500.png",{"path":510,"title":511,"description":512,"published":513,"category":364,"image":514,"draft":368},"\u002Fblog\u002Fvibe-coding-security-scanners-compared","Vibe coding security scanners compared, including ours","The best vibe coding security scanner comes down to three questions no feature list answers. Ten tools compared, with prices, and the jobs Reeve does not do.","2026-09-07","\u002Fblog\u002Fvibe-coding-security-scanners-compared\u002Fcard-800x500.png",{"path":516,"title":517,"description":518,"published":519,"category":364,"image":520,"draft":368},"\u002Fblog\u002Fsupabase-security-checker","Supabase security checker: run the five checks yourself","A Supabase security checker reads your published app instead of your project settings. Here are the five checks it runs, and how to run each one yourself.","2026-09-06","\u002Fblog\u002Fsupabase-security-checker\u002Fcard-800x500.png",{"path":402,"title":5,"description":367,"published":403,"category":364,"image":388,"draft":368},{"path":206,"title":523,"description":524,"published":525,"category":364,"image":526,"draft":368},"Missing security headers: when it actually matters","Missing security headers is the finding our scanner prints most. Here is what it protects against, and when it is the least urgent line on your report.","2026-09-04","\u002Fblog\u002Fmissing-security-headers\u002Fcard-800x500.png",{"path":528,"title":529,"description":530,"published":531,"category":364,"image":532,"draft":368},"\u002Fblog\u002Fopenai-api-key-exposed-in-frontend","Your OpenAI API key is exposed in your frontend. Rotate it.","An OpenAI API key exposed in your frontend cannot be locked to a domain. Rotate it today, move the call behind your own endpoint, and cap the spend.","2026-09-03","\u002Fblog\u002Fopenai-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":534,"title":535,"description":536,"published":537,"category":364,"image":538,"draft":368},"\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps","An API key exposed in your frontend: what 30,998 apps shipped","An API key exposed in your frontend is usually a Google Maps key. We scanned 30,998 live vibe-coded apps and counted which secrets actually leak.","2026-09-02","\u002Fblog\u002Fwhat-secrets-leak-from-vibe-coded-apps\u002Fcard-800x500.png",{"path":540,"title":541,"description":542,"published":543,"category":417,"image":544,"draft":368},"\u002Fblog\u002Fsupabase-backup-tools-compared","Supabase backup tools compared, including ours","Four kinds of Supabase backup tool, what each one actually copies, and the case where a free GitHub Action beats paying anyone, us included.","2026-09-01","\u002Fblog\u002Fsupabase-backup-tools-compared\u002Fcard-800x500.png",{"path":546,"title":547,"description":548,"published":549,"category":364,"image":550,"draft":368},"\u002Fblog\u002Freplit-secrets-explained","How to use secrets in Replit, and what still gets published","How to use secrets in Replit: add one, read it back, and fix the two reasons it comes back undefined. Plus the keys the Secrets tool cannot keep private.","2026-08-31","\u002Fblog\u002Freplit-secrets-explained\u002Fcard-800x500.png",{"path":552,"title":553,"description":554,"published":555,"category":417,"image":556,"draft":368},"\u002Fblog\u002Fback-up-supabase-free-tier","Supabase free tier backups: how to make one without a terminal","There are no Supabase free tier backups, so the copy has to come from you. How to make one from the dashboard, and what CSV leaves out.","2026-08-30","\u002Fblog\u002Fback-up-supabase-free-tier\u002Fcard-800x500.png",{"path":558,"title":559,"description":560,"published":561,"category":364,"image":562,"draft":368},"\u002Fblog\u002Fis-supabase-secure","Is Supabase secure? Yes. Your project is a separate question","Is Supabase secure? The platform is audited, encrypted and pen-tested. Their own compliance documents say where that stops and your settings begin.","2026-08-29","\u002Fblog\u002Fis-supabase-secure\u002Fcard-800x500.png",{"path":564,"title":565,"description":566,"published":567,"category":364,"image":568,"draft":368},"\u002Fblog\u002Fwhere-to-find-supabase-api-keys","Where to find your Supabase API keys: anon, service_role and the URL","Your Supabase project URL, anon key and service_role key are on one dashboard page. Here is where that page is, and which of the four belongs in your app.","2026-08-28","\u002Fblog\u002Fwhere-to-find-supabase-api-keys\u002Fcard-800x500.png",{"path":570,"title":571,"description":572,"published":573,"category":364,"image":574,"draft":368},"\u002Fblog\u002Fnew-row-violates-row-level-security-policy","New row violates row-level security policy in Supabase. Now what?","\"New row violates row-level security policy\" means Supabase refused a write. The fix that clears it in ten seconds also reopens the table to everyone.","2026-08-27","\u002Fblog\u002Fnew-row-violates-row-level-security-policy\u002Fcard-800x500.png",{"path":576,"title":577,"description":578,"published":579,"category":364,"image":580,"draft":368},"\u002Fblog\u002Fcors-wildcard-security-risk","Is a CORS wildcard a security risk? Usually not.","Is a CORS wildcard a security risk? Usually it is your builder default, and it gives away nothing your server was not already handing to anyone who asked.","2026-08-26","\u002Fblog\u002Fcors-wildcard-security-risk\u002Fcard-800x500.png",{"path":582,"title":583,"description":584,"published":585,"category":417,"image":586,"draft":368},"\u002Fblog\u002Fsupabase-branching-is-not-a-backup","Supabase branching is not a backup. It only goes forwards.","Supabase branching is not a backup: a branch starts with none of your data, and merging only moves schema. What it is for, and what to use instead.","2026-08-25","\u002Fblog\u002Fsupabase-branching-is-not-a-backup\u002Fcard-800x500.png",{"path":588,"title":589,"description":590,"published":591,"category":417,"image":592,"draft":368},"\u002Fblog\u002Fhow-to-restore-a-supabase-backup","How to restore a Supabase backup, and what breaks after","How to restore a Supabase backup from the dashboard or from a dump file, what the restore replaces, and why your app can still be broken when it finishes.","2026-08-24","\u002Fblog\u002Fhow-to-restore-a-supabase-backup\u002Fcard-800x500.png",{"path":594,"title":595,"description":596,"published":597,"category":364,"image":598,"draft":368},"\u002Fblog\u002Fsupabase-storage-bucket-public","Your Supabase storage bucket is public. Is that a problem?","A public Supabase storage bucket means anyone with a file URL can open it. It does not mean anyone can list what is in there. Two different settings.","2026-08-23","\u002Fblog\u002Fsupabase-storage-bucket-public\u002Fcard-800x500.png",{"path":600,"title":601,"description":602,"published":603,"category":364,"image":604,"draft":368},"\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend","Is a Google API key exposed in your frontend a problem?","A Google API key exposed in your frontend is the key our scanner finds most often, and usually it is fine. One free setting decides which it is.","2026-08-22","\u002Fblog\u002Fgoogle-api-key-exposed-in-frontend\u002Fcard-800x500.png",{"path":606,"title":607,"description":608,"published":609,"category":417,"image":610,"draft":368},"\u002Fblog\u002Fai-agent-deleted-my-database","An AI agent deleted my Supabase data. What can I recover?","An AI agent deleted your database data. What you can recover was decided before it ran, and the next few minutes decide how much of it survives.","2026-08-21","\u002Fblog\u002Fai-agent-deleted-my-database\u002Fcard-800x500.png",{"path":612,"title":613,"description":614,"published":615,"category":364,"image":616,"draft":368},"\u002Fblog\u002Fcan-anyone-read-your-supabase-database","Can anyone read your Supabase database? We checked 3,680 apps","Can anyone read your Supabase database without logging in? We scanned 30,998 live apps built with AI builders and measured how often the answer is yes.","2026-08-18","\u002Fblog\u002Fcan-anyone-read-your-supabase-database\u002Fcard-800x500.png",{"path":618,"title":619,"description":620,"published":615,"category":364,"image":621,"draft":368},"\u002Fblog\u002Fsource-maps-exposed-in-production","Source maps exposed: your app is publishing its original code","An exposed source map lets anyone read your app's original code, comments included. The 30-second check, and what actually matters if yours are public.","\u002Fblog\u002Fsource-maps-exposed-in-production\u002Fcard-800x500.png",{"path":623,"title":624,"description":625,"published":626,"category":364,"image":627,"draft":368},"\u002Fblog\u002Fsupabase-new-api-keys","Supabase's new API keys: which one is safe in your app?","Supabase replaced anon and service_role with publishable and secret keys. Which one belongs in your app, and which never does?","2026-08-12","\u002Fblog\u002Fsupabase-new-api-keys\u002Fcard-800x500.png",{"path":629,"title":630,"description":631,"published":632,"category":417,"image":633,"draft":368},"\u002Fblog\u002Fdoes-supabase-back-up-my-database","Does Supabase back up my database? It depends on your plan.","Does Supabase back up your database? Daily on paid plans, and not at all on the free one. How to check which you have, and what that copy cannot survive.","2026-08-11","\u002Fblog\u002Fdoes-supabase-back-up-my-database\u002Fcard-800x500.png",{"path":282,"title":635,"description":636,"published":637,"category":364,"image":638,"draft":368},"Supabase Row Level Security is on. Your table is still public.","Turning on Supabase Row Level Security does not protect a table. Your policies do, and the policy that fixed your broken app may let everyone in.","2026-08-10","\u002Fblog\u002Fsupabase-rls-on-but-table-still-public\u002Fcard-800x500.png",{"path":640,"title":641,"description":642,"published":637,"category":417,"image":643,"draft":368},"\u002Fblog\u002Fversion-history-is-not-a-backup","Version history is not a backup. It cannot undo a deleted table.","Lovable and Bolt keep version history for your code. Your database is a separate service, so rolling back to this morning does not bring your data back.","\u002Fblog\u002Fversion-history-is-not-a-backup\u002Fcard-800x500.png",{"path":645,"title":646,"description":647,"published":648,"category":417,"image":649,"draft":368},"\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database","Three ways to back up a Supabase database, and what each misses","The dashboard, pg_dump, and a managed service. What each one actually saves, what it quietly leaves out, and which one survives losing the account.","2026-08-09","\u002Fblog\u002Fthree-ways-to-back-up-a-supabase-database\u002Fcard-800x500.png",{"path":141,"title":651,"description":652,"published":648,"category":364,"image":653,"draft":368},"Which API keys are safe in your frontend, and which aren't","Your Supabase anon key is supposed to be public. Your service_role key is not, and it ignores every rule you set. Here is how to tell them apart.","\u002Fblog\u002Fwhich-api-keys-are-safe-in-your-frontend\u002Fcard-800x500.png",1790150951364]