Guides

One guide per tool: what usually goes wrong and how to fix it.

Lovable

How to secure your Lovable app before launch

Four things to check in a Lovable app (Supabase tables, keys in the browser, edge functions and storage buckets) and the prompts to fix each one.

Cursor

How to secure an app built with Cursor

Cursor writes fast and trusts everything. Here is how to stop leaked keys, committed .env files and unprotected API routes before they reach production.

Bolt

How to secure your Bolt app before you share the link

Bolt apps run in the browser and often call paid APIs directly. Learn how to move keys server-side, lock your database and publish safely.

Replit

How to secure a Replit app (Secrets, public repls and databases)

Use Replit Secrets properly, avoid exposing files through your deployment, and keep your database and API routes closed to strangers.