Security guides for the tools you build with
What to check before and after you ship an app built with Lovable, Bolt, Replit, v0, Cursor or Supabase, and how to fix what you find.
- Lovable security checklist for a live appWhat to check after you publish a Lovable app, where Lovable already helps, and what only an outside check of the live site shows.
- Fix it with your AI, prompts for Lovable, Bolt, Replit, v0, Cursor and Claude CodeHow to hand a security finding to the AI tool that built your app, with a fix prompt for each builder, and how to confirm the fix on the live site.
- Cursor security checklist for the app you shipCursor writes the code, your host serves the site. What to check in the project, what to check on the live site, and how to fix it from Cursor.
- Bolt app security checklist for a live siteWhat to check on a Bolt app before and after you publish it, what Bolt checks for you, and what the live site still shows to strangers.
- Default security settings of AI app builders, from their own docsWho can open your app, who sets data rules, which scan runs and where keys go, by default, in Lovable, Bolt, Replit, v0, Base44 and Google AI Studio.
- v0 app security checklist for a live Next.js siteHow environment variables, server code and the live site fit together in an app built with v0, and what to check before you share it.
- Supabase security checklist for apps built with AIKeys, row level security and the Data API grant change, explained for apps built with Lovable, Bolt, v0 or by hand, with what an outside check can and cannot prove.
- Run a Lockpick scan from Claude Code or CursorConnect Lockpick to Claude Code or Cursor in a minute, ask it to check your site, and let it fix what it finds while you approve every scan.
- Replit app security checklist for a live appWhat to check on an app you built with Replit before you share it, from secrets to permission checks, and what an outside check adds.