Guides
Step-by-step security guides for AI-built apps
Hands-on walkthroughs you can run on your own project: what to check, the exact commands, and how to fix what you find. Every guide lists its sources.
Guide
Supabase Row Level Security check: test and fix your tables
Find Supabase tables, views and storage buckets that anyone with your public key can read, then lock them down with Row Level Security policies you have tested.
Guide
Exposed API keys in AI-built apps: find, rotate, and prevent
Search your bundle, repo and git history for leaked secret keys, rotate the ones you find without downtime, and move the calls behind a server route.
Guide
Firebase security rules check: audit and fix before launch
Audit Firestore, Realtime Database and Cloud Storage rules for open access, replace them with user-scoped rules, and test them in the emulator before you deploy.
Guide
Security headers on Vercel and Netlify: setup and verification
Add HSTS, a Content-Security-Policy, nosniff, a referrer policy and clickjacking protection on Vercel or Netlify, roll out CSP safely, and verify with curl.
Guide
Pre-launch security runbook for apps built with AI tools
A launch-day runbook in time order for apps made with Lovable, Bolt, Cursor or v0: each check with the command or click path and the result that means pass.
Guide
How to run a two-account access test on your app
Test your own app for broken access control and IDOR with two test users, browser devtools and curl. Record results in a table and fix what fails.
Guide
Secret scanning with gitleaks and GitHub push protection
Scan your full git history with gitleaks, block secrets at commit time, add a CI check and turn on GitHub push protection. Plus what to do when it finds one.
Guide
Supabase RLS policy patterns for owner, team and public data
Copy-ready Supabase Row Level Security policies for owner-only, team, public-read and admin data, with WITH CHECK, indexes and SQL tests.
Guide
Private file uploads with Supabase Storage: policies and signed URLs
Set up a private Supabase Storage bucket with per-user folder policies, file size and type limits, signed URLs and a test that proves other users are blocked.
Guide
Rate limiting Next.js API routes with Upstash Redis
Design limits for login, OTP and paid API routes, then add them with @upstash/ratelimit. Return 429 with Retry-After and test with a curl loop on your own app.
Want the scanner when it ships?
Join the waitlist. One email when it opens, nothing else.