Short, practical answers for people shipping apps built with AI tools.
Built your app with Cursor, Lovable, Bolt or Claude? Check these 12 things before you share the link: keys, env files, previews, SEO and headers.
Your Supabase anon key is meant to be public. Your service_role key is not. Here's how to tell which one is in your site and what to do about it.
Every VITE_ variable is bundled into your public JavaScript. Here's what that means for API keys and how to keep secrets out of a Vite app.
Keep your OpenAI key out of the browser in Next.js: drop the NEXT_PUBLIC_ prefix and call OpenAI from a route handler. Copy-paste example inside.
A five-minute way to check whether your live site exposes API keys, using only your browser's DevTools. Includes the key prefixes to search for.
Leaked an OpenAI, Stripe or Supabase key? Do these steps in this order: rotate, check usage, move it server-side, and cap your spending.
If yoursite.com/.env loads, every secret in it is public. Here's the 10-second check, why it happens, and how to fix it on common hosts.
A public /.git folder lets anyone download your full source code and history, including secrets you deleted. Check yours and lock it down.
Firebase config keys are meant to be public. Your Security Rules are what protect your data. Here's what to check instead of hiding the key.
Google Maps keys live in your page, so restrict them to your domain and the APIs you use. Step-by-step in Google Cloud Console.
pk_ keys belong in your frontend. sk_ and rk_ keys never do. Here's the difference and what to do if a Stripe secret key ended up in your site.
Public source maps hand out your original, readable code. Here's how to check for them and turn them off in Vite and Next.js.
Shared your site and got a bare link? Add these Open Graph tags, use an absolute image URL at 1200×630, and clear the preview cache.
Still showing "Vite + React" in the browser tab? Change it in index.html, and set per-page titles if you use React Router.
Your meta description is the grey text under your link in Google. Keep it 120–160 characters, say who it's for, and give a reason to click.
Copy-paste robots.txt and sitemap.xml for a new site, how to check you're not blocking Google, and where to submit your sitemap.
Add HSTS, nosniff and clickjacking protection to a Vercel or Netlify site with one config file. Copy-paste examples for both.
A Content Security Policy limits which scripts can run on your site. Start in report-only mode, fix what it flags, then enforce it.
Calling an AI API straight from your frontend puts your key in every visitor's hands. Here's the safe pattern and a minimal server example.
Add a favicon that shows in browser tabs, bookmarks and phone home screens: an SVG or ICO, an apple-touch-icon, and the right link tags.
Free scan for leaked API keys, exposed .env files, link previews, SEO basics and security headers.