Guides
Guides
Security and findability guides for apps built with Lovable, Bolt, Cursor, Replit and v0.
Lovable security scan: how to check your Lovable app before (and after) you launch
A practical security checklist for Lovable apps: leaked API keys in the Vite bundle, Supabase Row Level Security, exposed files, headers, and how to keep checking after every prompt.
Read guideSupabase RLS checker: how to test that Row Level Security actually protects your tables
How to check Supabase Row Level Security properly: enabled vs. effective, the anonymous-read test with curl, views, RPC functions, storage buckets, and fixing policies.
Read guideIs the Supabase anon key safe to expose? Yes, if (and only if) RLS is right
The Supabase anon (publishable) key is meant to be public, but it's only safe when Row Level Security protects every exposed table. Here's what the key can do, what it can't, and how to check.
Read guide