Is your Supabase service_role key exposed in your frontend JavaScript?
The one Supabase key that should never leave your server, and why it ends up in the client bundle more often than you'd think.
Blog
Security notes
Practical notes on what actually gets exploited, written for developers shipping fast, not a compliance checklist.
The security headers checklist every website needs
CSP, HSTS, X-Frame-Options, and the rest: what each one actually protects against, and how to check yours in under a minute.
What is Supabase Row Level Security, and how do you know if it's misconfigured?
RLS is the only thing standing between your database and the public internet once a key is exposed. Here's how it actually works.
Why "vibe-coded" apps get hacked: 5 mistakes we see constantly
The same five issues, over and over, across apps built fast with AI assistance. None of them take long to fix once you know they're there.