Guides
Guides
Longer notes for the failures that show up when an AI coding tool ships a real backend: keys in the bundle, open rules, and routes with no auth check.
- 01GuideHow to check if your API key leaked on GitHubSearch your repo, your git history, and GitHub's own alerts for exposed keys, then know what to do when you find one.
- 02GuideNext.js Server Actions securityServer Actions are public HTTP endpoints. How to add authentication, authorization, and input validation so AI generated actions are safe to ship.
- 03GuideReplit Secrets guideHow to store API keys in Replit Secrets, read them safely in code, and avoid leaking them through public Repls, frontends, and logs.
- 04GuideA security review prompt for AI coding toolsA copy-paste prompt that asks an AI coding tool for a security review, plus how to read the answer without trusting it blindly.
- 05GuideSupabase anon key vs service role keyWhich Supabase key is safe in the browser, which one bypasses Row Level Security, and where each belongs in a Lovable, Bolt, or Next.js app.
- 06GuideCommon vulnerabilities in vibe-coded appsHow IDOR, exposed service role keys, and missing auth on API routes show up in apps built with AI coding tools.
- 07GuideSecuring Stripe webhooksVerify the Stripe-Signature header on the raw body, keep the webhook secret on the server, and ignore duplicate events.
- 08GuideKeep secrets out of frontend codeWhat Next.js and Vite put in the browser bundle, and where Supabase, Firebase, and Stripe keys actually belong.
- 09GuideThe first hour after an API key leaksRevoke the key first. Then check logs, replace it with less privilege, and clean up git only after the old key is dead.