Your API key is probably sitting in your JavaScript
Anything your browser downloads can be read by anyone. Here is how AI-built apps leak OpenAI, Stripe and Supabase keys, and how to fix it in ten minutes.
Blog
Security for people who build with AI, in plain words.
Supabase Row Level Security in plain English
What RLS is, why a Supabase table with it switched off is open to the whole internet, and the exact steps to lock yours down.
A 10-minute security checklist before you launch your AI-built app
Seven checks that catch the most common ways Lovable, Cursor, Bolt and Replit apps leak data, with a plain-English fix for each.