Guides

How to check the security of your web app, one question at a time, with the commands to run and what to fix first.

• Is my Lovable app secure?Lovable apps are as secure as their Supabase rules and secret keys. Check Row Level Security, keys in the frontend, edge functions and storage.
• How to check Supabase Row Level Security (RLS)Find Supabase tables without RLS, spot policies that let everyone in, and test your tables with the anon key the way an attacker would.
• Is my API key exposed in my website’s JavaScript?Any key in your frontend code ships to every visitor. Find it in your built JavaScript and source maps, know which keys are safe, and rotate the rest.
• Is my Bolt app secure?Bolt apps are usually a Vite and React frontend on Supabase. Keep secret keys out of VITE_ variables, turn on RLS, and check what your live site exposes.
• Is my Cursor app secure?Cursor writes code fast but doesn’t decide what reaches the browser or who can call your API routes. What to review in the code and on the live site.
• Is Cursor safe? How to use it securelyYes, with the right settings: Privacy Mode, secrets out of the agent’s reach, a careful run mode and trusted MCP servers. Then check the code it writes.
• How to choose a security scanner for a Lovable appChoose by what a scanner can see: a URL scan finds leaked keys and files, not your Supabase rules. What each kind of scan covers and what to ask first.
• How to fix Node2Shell (CVE-2026-111497) in Node.jsUpdate Node.js to 22.23.4, 24.22.1 or 26.12.1. Who is exposed to the Brotli bug, how to check your version, what to do on Vercel and if you can’t update yet.
• How to fix PHP2Shell (CVE-2026-109618, CVE-2026-109619)Update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Who is at risk from the PHP2Shell remote code execution bugs, how to check your site, and what to do meanwhile.