Securing apps built with Cursor, Lovable, Bolt, and v0
A checklist for apps generated by coding agents: secrets in the client bundle, database rules, headers, and files you did not mean to publish.
A coding agent will produce a page that loads. The defaults that make the preview work are not the same defaults you want once a stranger can open the URL. The browser bundle, the database role that bundle uses, and the headers on the response are all part of the product, even when nobody wrote them by hand.
Check these before the first real user
- Search the built JavaScript for service_role, sk_live_, sk_test_, rk_live_, and long-lived tokens such as OpenAI keys, GitHub tokens, and database URLs that include a password.
- Confirm the database refuses an anonymous read. On Supabase that means row level security is on, and the policies are not USING (true) for the world.
- Request /.env and read the body. A single-page host often returns the HTML shell for every path. A body of NAME=value lines is a leaked env file.
- Read the response headers. HTTPS from the host is not HSTS, a frame policy, or a content security policy.
The free FlowCheck scan does those reads and nothing else. It does not submit forms, guess passwords, or write data. After that, describe signup in plain language so the path itself is checked on a schedule and, on a paid plan, when a deploy webhook fires.
Exposed API keys in the client bundle