Vibe-coded app rescueYour AI-built app, made safe for real users.

1. 1Row Level Security missing or wrong. Tables readable, or even writable, by anyone who opens the browser console.
2. 2Secret keys in the front end. Supabase service-role keys, Stripe secret keys or AI provider keys bundled into the JavaScript anyone can download.
3. 3Checks only in the interface. The admin page is hidden, but its API calls work for any signed-in user.
4. 4Paid features unlocked from the browser. A success page, not a verified webhook, decides who has paid.
5. 5No limits on AI endpoints. One script can burn through your AI credits overnight.
6. 6Unvalidated input. Forms and APIs accept anything, from oversized uploads to script tags.
7. 7No error tracking. Sign-up breaks after a prompt, and you find out a week later.
8. 8No tested backups. A bad prompt or migration deletes data, and there is nothing to restore.
9. 9Invisible to Google. Many builders produce a client-rendered app, so search engines and link previews see an empty page.

Apps built with Lovable, Bolt and similar tools often talk to Supabase straight from the browser, using a public “anon” key. That is fine by design, but only if Row Level Security (RLS) is switched on for every table, with policies that say exactly who can read and change each row. Without it, the public key opens the whole table.

-- Turn on Row Level Security for the table.
alter table public.projects enable row level security;

-- Users can read only their own rows.
create policy "Owners can read their projects"
  on public.projects for select
  using ((select auth.uid()) = user_id);

-- Users can update only their own rows, and cannot hand them to someone else.
create policy "Owners can update their projects"
  on public.projects for update
  using ((select auth.uid()) = user_id)
  with check ((select auth.uid()) = user_id);

Most apps I see are rescue cases. Rewriting throws away working product and months of learning. The audit on day one tells you honestly which case you are in, and if a rewrite is the better call, you will hear it before any fixing starts.

After the rescue you can keep prompting. The report includes a short checklist to run after every AI change: new tables get RLS policies, new keys stay server-side, and new features get a server-side check. Tests on your critical flows (an add-on) catch regressions automatically on every deploy.

If you would rather have a developer on call as you grow, a monthly subscription covers new features, reviews of AI-generated changes, and fixes, without a new quote each time.