Guides
Security guides for the app you shipped fast
Every guide here covers one way a shipped app leaks: Supabase row level security left off, Firebase rules still in test mode, secret keys bundled into the browser, missing security headers. Each one names what breaks, who can see it, and the exact change that closes it.
What Is Row Level Security? The WHERE Clause Postgres Adds for You
What is row level security, in plain terms: a Postgres rule that filters rows per caller. Turn it on, write a policy, and find the tables still missing it.
Read the guide →Vibe Coding Security: The Pre-Launch Checklist
Vibe coding security is what the AI skips: open database rules, keys in the bundle, routes with no auth. Here is the pre-launch checklist that closes them.
Read the guide →Firebase Security Rules Checklist (Firestore + Storage)
Open Firestore rules let strangers read or write your data. Here are firebase security rules that scope every document and file to its owner, copy-paste ready.
Read the guide →How to Find Exposed API Keys in Your Frontend
Secret keys in your client bundle are public to anyone with devtools. Here is how to find leaked API keys in your frontend and what to rotate first.
Read the guide →Supabase Row Level Security, Fixed With Copy-Paste Policies
Supabase row level security decides which rows your public key can read. Here is how to find the tables that are still open, enable it, and write policies.
Read the guide →Supabase Security: The 9-Step Pre-Launch Checklist
A nine-step Supabase security pass before launch: row level security, owner policies, the service_role key, Storage buckets, grants and a check from outside.
Read the guide →Free tools
Checks you can run against a live URL right now, no signup.