Security guides for apps built with AI.
What leaks in apps made with Lovable, Bolt, Cursor or Claude Code, why it leaks, and how to check yours. Written from the attacks Keybrum runs every day, with the fix you can paste.
Apps built with AI
Where generated apps leak, and how to check yours before someone else does.
- Vibe coding security risks: the 8 holes AI-built apps ship withVibe coding security risks, with public evidence: the 8 holes AI-built apps ship with, how to check your live app for each, and a plan for this week.Read
- Vibe coding security checklist: 8 layers to test on your live app before launchA vibe coding security checklist in 8 layers: data, keys, auth, per-user access, AI routes, files, CVEs, deploys. Each item says how to test your live app.Read
- IDOR vulnerability: when one user can see another user's dataAn IDOR vulnerability lets one user read or change another user's data by swapping an id. Test it with two accounts, then fix it in Supabase or Firebase.Read
- Protect your OpenAI API route: auth, per-user limits and spend capsAn AI route that answers anyone runs prompts on your bill. How to protect an OpenAI API route: auth check, per-user quota, server-side key, spend caps.Read
- Stripe webhook secret: how to verify every event and refuse fakesThe Stripe webhook secret (whsec_) is how your server refuses forged payment events. Where to find it, raw body code for Next.js and Express, and a test.Read
Supabase
Keys, row level security and storage: the settings that decide who can read your tables.
- Supabase anon key: is it safe to expose, and what can it reach?The Supabase anon key is public by design. Row level security is what protects your data. What the key reaches, how to test your tables, when to rotate it.Read
- Supabase service role key: where to find it, where it belongs, what to do if it leaksThe Supabase service role key skips every RLS policy. Where to find it, where it may live, how to spot it in your bundle and how to rotate it after a leak.Read
- Supabase access token: session JWT or personal access token, and what each can doA Supabase access token is a user's session JWT or a personal access token (sbp_). How to get and verify each, how long it lives, what to do if one leaks.Read
- Supabase RLS: how row level security works, the policies you need, and how to test themSupabase RLS explained with SQL to paste: enable it, five policy patterns, the mistakes that leak data, and how to test as a stranger and as a second user.Read
- Supabase anon key vs publishable key: what changed and how to migrateSupabase anon key vs publishable key: same role, same RLS, new format and rotation. The four keys compared, the migration steps and the traps after it.Read
- Supabase storage security: public buckets, policies and signed URLsSupabase storage security in practice: what a public bucket exposes, storage.objects policies for per-user folders, listing vs downloading, signed URL expiry.Read
Firebase
Security rules and API keys, with the rules that hold and the ones that only look like they do.
- Firebase security rules: examples that leak data, and rules to paste insteadFirebase security rules examples for Firestore, Realtime Database and Storage: the rules that leak data, owner and role rules to paste, and how to test them.Read
- Firebase API key exposed: is it a secret, and when is it a problem?An exposed Firebase API key is normal: rules and App Check guard your data. When the same Google key can bill you for Gemini or Maps, and how to check yours.Read
Keys and secrets
What a visitor's browser receives, what a leaked key costs, and the order to fix it in.
- API key exposed in frontend: which keys are safe, and how to fix a leakAn API key in your frontend is public: VITE_, NEXT_PUBLIC_ and EXPO_PUBLIC_ values ship to every visitor. Which keys are safe, how to check, the fix.Read
- API key leaked: what to do, in order, before you touch the codeAPI key leaked? What to do, in order: rotate, revoke, check usage and billing, then clean git. Steps for OpenAI, Anthropic, Stripe, AWS, Supabase and GitHub.Read
- Env file exposed: how to check your site for .env, .git, source maps and backupsEnv file exposed? Anyone can read your database password and API keys. Check your own site for .env, .git, source maps and backups, and block them.Read
Scanners and headers
What an online scan sees, what it cannot, and the response headers every app should send.
- Website vulnerability scanner: what it checks and what it misses on AI-built appsA website vulnerability scanner checks headers, TLS, versions and exposed files. What free scanners find, what they miss on AI-built apps, how to read a scan.Read
- Security headers: what each HTTP header does and how to set itSecurity headers tell the browser what your app may do. The six that matter, four to drop, and config to paste for Next.js, Vercel, Netlify and Cloudflare.Read
Penetration testing
What a pentest is, what it costs, what the report looks like, and when an automated one is enough.
- Automated pentest: what it can prove, what it misses, and how to choose oneAn automated pentest attacks your live app and reports only what worked, with proof. How it works, how it differs from a scanner, its limits, how to choose.Read
- AI pentest: what an AI agent can prove, and how to test your own AI featuresAn AI pentest means two things: AI attacking your app, or a test of your AI features. Where agents help, where they invent findings, and what proof to demand.Read
- Web app pentest: what gets tested, how it runs, how to prepareA web app pentest attacks your live app to prove what a stranger can reach. The phases, OWASP 2025 mapped to Next.js and Supabase, prep and retests.Read
- Pentest report sample: a proven finding, section by section, and a template to reuseA pentest report sample, section by section: summary, scope, a finding proven on a demo app, severity, fix and retest status, and a template you can reuse.Read
- How much does a pentest cost? 2026 prices, retests and what to buyHow much does a pentest cost in 2026? Published prices for manual, PTaaS and automated tests, what drives a quote, retests, and what to buy at each stage.Read
- Pentest vs vulnerability scan: what each one proves, and when you need itPentest vs vulnerability scan: a scanner lists what might be wrong, a pentest proves what an attacker can do. One app, both reports, and when you need each.Read
- Pentest methodology: the phases in order, and the standards behind themPentest methodology in eight phases, from scoping to retest, shown on a Next.js and Supabase app, with PTES, OWASP WSTG, NIST and PCI compared side by side.Read
- External pentest: what it covers for a modern app, and how to prepareAn external pentest attacks your app from the internet with no inside access. What it covers on Supabase, Firebase, Vercel or a VPS, and how to prepare.Read
- White box pentest: what it finds in an AI-built app, and what it cannot proveA white box pentest gives the tester your code, migrations and rules. What it finds in an AI-built app, what only a live test proves, and what to hand over.Read
- PCI DSS pentest: who needs one, and what requirement 11.4 asks forA PCI DSS pentest applies to SAQ A-EP, SAQ D and service providers, not SAQ A. Find your SAQ, what requirement 11.4 asks and what an assessor checks.Read
- Security questionnaire: what buyers ask and how to answer without a security teamHow to answer a security questionnaire as a startup: the questions buyers ask, template answers for the testing section, and evidence that ends follow-ups.Read
By platform
Each builder ships a different stack, so each one leaks in its own places. Pick yours.
- Next.jsNext.js security: the CVEs, defaults and holes to check in your appRead
- Bolt.newBolt.new security: what Bolt checks for you, and where Bolt apps still leakRead
- Claude CodeClaude Code security: what the agent protects, and what you still ownRead
- CursorCursor app security: what Cursor checks, and what you still ownRead
- FirebaseFirebase security: what Google handles, and where your app still leaksRead
- Base44Is Base44 safe? What the platform protects, and what to check in your appRead
- ReplitIs Replit safe? What the platform protects, and what your app still needsRead
- LovableLovable security: is Lovable safe, and what your app still needsRead
- SupabaseSupabase security: is Supabase secure, and what does your app still need?Read
- v0v0 security: is v0 safe, and where v0 apps still leakRead
CVE watch
The vulnerabilities that reach apps built with AI, explained, with the version that fixes them.
- CVE-2025-55184highCVE-2025-55184: the React Server Components denial of service, and how to fix itCVE-2025-55184 lets one request hang a Next.js App Router or React Server Components server. Who is affected, how to check your version, the fix.Read
- CVE-2026-94482highCVE-2026-94482: the Next.js Server Actions denial of service, who is affected and the fixCVE-2026-94482 lets crafted requests stall a Next.js App Router server through Server Actions. Who is affected, how to check your app, and the fix.Read
- CVE-2026-94483highCVE-2026-94483: the Next.js image optimizer SSRF, who is affected and how to fix itCVE-2026-94483 lets an allow-listed image host steer Next.js 16 to private IPs. Who is exposed, how to check your version, and the fix in 16.3.8.Read
Free tools
Small checks you can run right now, most of them without anything leaving your browser.
- Security headers checkerPaste an address: see which security headers your site sends, which are missing, and the exact line to add for each.Free, no accountOpen
- Supabase key checkerPaste a Supabase key: learn in one second whether it is the public anon key or a service role key that must never leave your server.Runs in your browserOpen
- Supabase RLS checkerOne query in your SQL editor lists every table without row level security and every policy that lets anyone in.Runs in your browserOpen
- Firebase rules checkerPaste your Firestore, Realtime Database or Storage rules: every rule that lets a stranger read or write is flagged, with the fix.Runs in your browserOpen
- Next.js and React CVE checkerEnter your Next.js and React versions, or paste package.json: see every known CVE that applies and the version that fixes it.Runs in your browserOpen
- API key leak checkerPaste JavaScript, an env file or a config: every API key in it is named, rated public or secret, and given its rotation steps.Runs in your browserOpen