Field notes on Supabase RLS, leaked secrets, and everything that quietly breaks when an AI coding tool ships your app for you.
A launch decision needs evidence, not vibes. Here are the seven checks that decide whether an AI-generated app is safe to ship — and what proof each one should produce.
Row-level security is the difference between a private app and a public database. Twelve concrete checks, the SQL to run them, and the mistakes AI code generators make most often.
The service-role key bypasses every access rule you wrote. AI coding tools wire it into client code more often than anyone expects. Here is how to find it, and what to do next.
Lovable ships working apps fast. The security defaults are yours to set. A publish-day checklist covering database rules, keys, edge functions, auth and headers.
Missing security headers are the most common finding in AI-built apps and the cheapest to fix. What each header does, sane starting values, and how to verify them.
AI generates code faster than anyone can read it. A repeatable review method: follow the data, not the diff — trust boundaries, authorisation, secrets and dependencies.
RLS is the only thing between your public anon key and your entire database. Here’s how it works, how to find exposed tables, and the mistakes that still leak data even when it’s on