https://vibeprotect.dev/blog Security guides for apps built with AI app builders, from Instant City Solutions LLC. en Fri, 02 Oct 2026 12:00:00 GMT https://vibeprotect.dev/blog/dont-become-a-linkedin-post https://vibeprotect.dev/blog/dont-become-a-linkedin-post Fri, 02 Oct 2026 12:00:00 GMT Frank Robles A founder ships an AI-built app Saturday. By Wednesday a stranger has the OpenAI key. By Thursday LinkedIn has 9,000 takes. The 10 minutes that prevent it. https://vibeprotect.dev/blog/vibe-coding-security-checklist https://vibeprotect.dev/blog/vibe-coding-security-checklist Fri, 02 Oct 2026 12:00:00 GMT Frank Robles Vibe coding security checklist: 12 checks before strangers use your app. Leaked keys, Supabase RLS, Firebase rules, .env in GitHub, each with a fix prompt. https://vibeprotect.dev/blog/is-lovable-secure https://vibeprotect.dev/blog/is-lovable-secure Fri, 02 Oct 2026 12:00:00 GMT Frank Robles Is Lovable secure? Yes. Apps built with it leak in four ways: VITE_ keys, the service_role key, tables without RLS, GitHub sync. How to check yours and fix it. https://vibeprotect.dev/blog/supabase-rls-lovable https://vibeprotect.dev/blog/supabase-rls-lovable Fri, 02 Oct 2026 12:00:00 GMT Frank Robles Supabase RLS in Lovable apps: find every table with RLS disabled, spot policies that let everyone in, and fix them with copy-paste SQL or a Lovable prompt. https://vibeprotect.dev/blog/api-key-exposed-frontend-javascript https://vibeprotect.dev/blog/api-key-exposed-frontend-javascript Fri, 02 Oct 2026 12:00:00 GMT Frank Robles API key exposed in frontend JavaScript? The 10-minute response: rotate it, check usage, move the call server-side, clean VITE_ vars, verify it is gone. https://vibeprotect.dev/blog/replit-app-security https://vibeprotect.dev/blog/replit-app-security Fri, 02 Oct 2026 12:00:00 GMT Frank Robles Replit app security: Replit is trusted, with Secrets, Auth and its own scanner. Agent-built apps still ship six holes: VITE_ keys, routes without auth, open CORS.