// GUIDES
Security guides for people who build with AI.
Practical, plain-English how-tos for founders shipping apps with Lovable, Bolt, Cursor, Replit and v0: what to check, how to lock it down, and how to launch safely.
- The complete security checklist for AI-built appsA real, work-through security checklist for apps built with Lovable, Bolt, Cursor, Replit or v0, database, keys, auth, payments, storage, CORS and git.
- 7 security holes AI coding tools leave behindThe seven security holes Lovable, Bolt, Cursor, Replit and v0 quietly ship, what each one is, why AI tools cause it, what it costs, and how to fix it.
- Supabase Row Level Security, explained for non-developersWhat Supabase Row Level Security actually is, why the public anon key is safe only when RLS is right, the "using (true)" trap, and how to verify, in plain English.
- How to secure your AI-built app before launchA founder's ordered, pre-launch hardening walkthrough for AI-built apps on Supabase/Firebase + Stripe + Next.js, the exact steps, in the order to do them.
- Are AI-generated apps safe to launch?An honest answer for founders: AI-built apps can be safe to launch, but AI tools optimize for "works," not "secure." Here are the recurring gaps to check first.
- Is it safe to take payments on a vibe-coded app?Taking Stripe payments on an AI-built app is safe only if the server verifies the money. Here are the traps: client-side "success," unverified webhooks, price tampering.
- Security checks before launching your SaaSA short pre-launch security checklist for AI-built SaaS: the handful of checks that actually matter, open databases, exposed keys, auth, payments, uploads.
- Free ways to check your app vs VeilguardA fair look at the real ways to check an AI-built app for security holes, DIY checks, free tools, hiring a pentester, and Veilguard. What each catches, misses, and costs.