Security guides, one per builder

Each tool leaves a different set of doors open. Pick yours, read what usually goes wrong, and scan the app right on the page.

Lovable

Is your Lovable app leaking?

Lovable apps ship a Supabase key in the browser by design. Whether that is safe depends on Row Level Security. Scan your Lovable app free; the report explains each finding, and Pro shows the exact SQL to fix it.

Bolt

Is your Bolt app leaking?

Bolt apps deploy to Netlify in one click, often with Supabase or Firebase behind them and keys in the browser bundle. Scan your Bolt app free; the report explains each finding, and Pro shows the paste-ready fix.

v0

Is your v0 app leaking?

v0 generates Next.js on Vercel. NEXT_PUBLIC_ variables, open route handlers, and missing headers are the usual leaks. Scan your v0 app free and get next.config.js and route-handler fixes.

Replit

Is your Replit app leaking?

Replit Agent apps run your own server, so headers, CORS, and the files it serves are yours to get right. Scan your Replit app free and get Express and Nginx fixes.

Cursor

Is your Cursor-built app leaking?

Apps built with Cursor can be any stack. The leaks are the same: a committed .env, a key hardcoded to get unblocked, source maps, a wildcard CORS line. Scan free and check the connected repo too.