Fixes
Security errors and scan findings, with the exact fix
One page per error message or finding: what it means, why it happens in AI-built apps, the fix, and a test that proves it worked.
18 pages
Fix
Fix: new row violates row-level security policy (Supabase)
Why Supabase returns 'new row violates row-level security policy for table' on insert or upsert, and the policy that fixes it without opening your data.
Fix
Fix: Supabase RLS enabled, no policy (query returns empty array)
Your Supabase select returns [] even though the table has data. The cause is RLS enabled with no policy. Here is the safe policy to add.
Fix
Fix: RLS disabled in public (Supabase security advisor)
The Supabase advisor error 'RLS Disabled in Public' means anyone with your project URL can read and change the table. How to enable RLS safely.
Fix
Fix: Supabase service_role key exposed in your frontend
A Supabase service_role or secret key in browser code bypasses all RLS. Rotate it first, then move the code server-side and purge it from git history.
Fix
Fix: FirebaseError: Missing or insufficient permissions
What 'FirebaseError: Missing or insufficient permissions' means in Firestore, the rules and query mistakes that cause it, and a safe owner-only rule.
Fix
Fix: Firebase rules allow read, write: if true (public rules)
Firebase rules left in test mode let anyone read and overwrite your database. How to replace allow read, write: if true with owner-based rules.
Fix
Fix: No 'Access-Control-Allow-Origin' header is present (CORS)
Why the browser blocks your fetch with a CORS error, how to return the right Access-Control-Allow-Origin header, and the wildcard fix to avoid.
Fix
Fix: Refused to load the script (Content Security Policy)
Why the browser refuses a script under your Content Security Policy directive, how to allow the right source with a host or nonce, and what not to add.
Fix
Fix: Mixed Content: page loaded over HTTPS, insecure resource
Why browsers block http:// requests from an HTTPS page, how to find every insecure URL in your app, and the right fix for APIs without HTTPS.
Fix
Fix: Strict-Transport-Security (HSTS) header missing
What a missing HSTS header means, the exact Strict-Transport-Security value to send, how to add it on Next.js, Vercel and Netlify, and how to roll it out.
Fix
Fix: Content-Security-Policy header missing
What a missing Content-Security-Policy header means, a starter policy you can adapt, and how to roll it out in report-only mode without breaking your app.
Fix
Fix: X-Frame-Options missing (clickjacking protection)
What a missing X-Frame-Options or frame-ancestors header means, how clickjacking works, and the two headers that stop other sites framing your app.
Fix
Fix: cookie without Secure, HttpOnly or SameSite flags
What the Secure, HttpOnly and SameSite cookie attributes do, why a session cookie needs all three, and how to set them in Next.js and Express.
Fix
Fix: .env file publicly accessible on your website
If yourapp.com/.env returns your environment file, every secret in it is compromised. Rotate first, then remove the file, block dotfiles and clean history.
Fix
Fix: .git directory exposed (/.git/config reachable)
If yourapp.com/.git/config loads, your source code and commit history can be downloaded. How to block it, what to rotate, and how to deploy without .git.
Fix
Fix: secret exposed in a NEXT_PUBLIC_ or VITE_ variable
NEXT_PUBLIC_ and VITE_ variables are copied into your JavaScript bundle. If one holds a secret key, rotate it and move the call to the server.
Fix
Fix: GH013 Push cannot contain secrets (GitHub push protection)
GitHub blocked your push because a commit contains a secret. How to rotate it, remove it from the commit with amend or rebase, and push again.
Fix
Fix: No DMARC record found (and SPF missing)
Without SPF and DMARC records, anyone can send email that appears to come from your domain. The exact DNS records to add and how to tighten them safely.
Ready to check your own app?
Sign in with Google or email, add your site and run your first scan free.