Security for AI-built apps, by platform

Each builder leaves its own kind of gap. Pick the one you used to see the usual problems, what Shypset checks from outside and how to fix it with your AI tool.

1. 01
   Lovable app security: what to check before you launch

   Supabase access rules, keys in the bundle, headers on *.lovable.app and custom domains.

2. 02
   Bolt.new app security: find what the build left open

   Secrets that end up in the frontend, open databases, deploy defaults.

3. 03
   v0 app security: what a generated Next.js app can leak

   NEXT_PUBLIC_ variables, header defaults, Supabase and Firebase from the client.

4. 04
   Replit app security: check your deployment from outside

   Server files served by mistake, secrets outside Replit Secrets, header defaults.

5. 05
   Security for apps built with Cursor

   Stack-agnostic: client env prefixes, source maps, rules on Supabase and Firebase.

6. 06
   Supabase security: is your data readable without login?

   Row Level Security, the anon key, service_role leaks.

7. 07
   Firebase security: rules, not the config, protect your data

   Public web config, Realtime Database rules, keys from other Google APIs.

Looking for a specific problem? See what we check.