Guides

Practical security checks for AI-built apps

Direct answers, reproducible examples, provider-aware distinctions, and an explicit line between public evidence and authorized testing.

Stripe · API key exposure

Stripe publishable vs secret API keys

Stripe pk keys belong in client code; sk and rk keys stay on the server. Compare test/live prefixes and what to do if a privileged key is exposed.

Updated

Firebase · public API keys

Firebase API key exposed: is it a secret?

A Firebase API key in web or mobile code is usually public by design. Verify API restrictions, Security Rules, App Check, and separate secret credentials.

Updated

Supabase · Row Level Security

Supabase RLS security checklist

Review Supabase Row Level Security with an evidence-led checklist for grants, policies, tenant boundaries, views, functions, claims, and authorized role tests.

Updated

Supabase · privileged key exposure

Supabase service_role key exposed: what to do

A practical response plan for a Supabase service_role or secret key exposed in browser code, a repository, logs, or another public location.

Updated

Supabase · API key location

How to find your Supabase API keys

Find Supabase publishable, secret, anon, and service_role keys in the current dashboard, then choose the right key for browser or server code.

Updated