Security checks before launching a vibe-coded app

Symptoms

• Anyone with the public key in your page can read and write all data
• A sudden bill spike (stolen key)

Common causes

• Tables have no row-level security (RLS) or overly broad policies
• Third-party API keys were put in front-end code

How to fix

1. With Supabase, run alter table ... enable row level security on every table; once enabled, no data is accessible through the API with the publishable key until you add policies (per the docs)
2. Write least-privilege policies: signed-out users get nothing, signed-in users only their own rows
3. Move third-party API keys into server functions or the platform’s secrets store; no secrets in the front end
4. Run the built-in security scan before publishing (Lovable offers quick and deep scans) and fix each finding
5. Test in another browser while signed out to confirm you can’t see others’ data

Notes

• Apps handling payments, health or sensitive personal data need a professional review before launch