Guides
Security fixes for AI-built apps
Each guide shows the broken pattern, the fix, and why it matters. Paste one into your AI coding tool and ask it to find and fix anything that matches.
- Prompt injection and other risks in AI features: Keep user input out of the system prompt, treat model output as untrusted, keep agent tools narrow, and put a login and rate limit on every AI endpoint.
- Pre-launch security checklist for AI-built apps: Twenty-five things to check before you launch an app built with Lovable, Bolt, Cursor or Claude Code, with a link to the fix for each.
- Securing Next.js API routes and server actions: Check auth in every route and action, verify the user on the server, check ownership, validate input and avoid open redirects.
- How to find secrets exposed to the browser (Next.js, Vite and others): Hard-coded keys, server keys with a public prefix, committed .env files and LLM keys in client code: how to spot each and fix it.
- How to verify Stripe webhooks in Next.js, and the other payment mistakes to check: Verify the signature, grant access only from the webhook, handle each event once, and never take the price from the browser.
- How to check Supabase row-level security before launch: Tables without RLS, policies that let everyone in, missing with check, roles in user_metadata, views and security definer functions: what goes wrong and the fix for each.