Notes on keeping your app safe once it is live
Plain write-ups of the problems we see from outside a live site, with the fix for each one.
- How do I set Secure, HttpOnly and SameSite on my sign-in cookie?What Secure, HttpOnly and SameSite do on a sign-in cookie, which ones your app needs, and how to add them yourself or with your AI builder.
- Supabase anon key vs service role key, which one can be in your frontendThe anon or publishable key belongs in the browser and the service role or secret key never does. What each one can reach, and what to do if the wrong one shipped.
- Security checks your coding agent can run on your live siteWhat a coding agent connected to Lockpick can check, read and fix on a site you own, what each step costs, and what it can never do on its own.
- Your OpenAI or Anthropic key is in the browser. Now what?What to do in the next ten minutes when an AI provider key is in your frontend code, how to move AI calls to your server, and how to confirm the fix.
- How Lockpick checks a site, and what we never doWhat a Lockpick scan reads, the limits it never goes past, what needs your permission, and the lines we never cross, in one page.
- .env file publicly accessible, how it happens and how to fix itWhy a settings file can end up at a public address on your site, the build and hosting mistakes behind it, and the order to fix it in.
- An API route answers without signing in, what it means and how to fix itWhy an API route that returns data to anyone is a real risk, why hiding it in the page does not help, and how to add the check in Next.js and other stacks.
- API keys in your JavaScript bundle, how they get there and what to doWhy a secret key in your frontend code is readable by anyone, how build tools put it there, which keys are fine to ship, and the order to fix it in.