Securing Next.js + Supabase, in depth
The specific mistakes that get apps on this stack hacked — and the exact fix for each. No generic checklists.
- ·4 min read
Catch API Keys Before They Hit GitHub
A leaked API key is scraped within minutes of hitting GitHub. Here's how to catch secrets with a local pre-commit hook plus a scan on every push.
SecretsGitNext.jsCI - ·5 min read
Keeping Secrets Out of a Next.js App
The four ways secrets leak from a Next.js app — NEXT_PUBLIC_, client imports, hardcoding, git history — and the pattern that keeps each one server-side.
Next.jsSecretsSupabaseSecurity - ·4 min read
Your MCP Config Is Leaking Secrets
MCP config files like .mcp.json get committed to git — and a database password or API key pasted inline leaks to everyone. Here's the ${env} fix.
MCPSecretsAISupabase - ·28 min read
Supabase Row Level Security: the Complete Guide
The complete practical guide to Supabase RLS: grants vs policies, USING vs WITH CHECK, the patterns that hold, what bypasses RLS, and how to verify it.
SupabaseRLSPostgresSecurity - ·4 min read
A Security Checklist for Vibe-Coded SaaS Apps
AI coding tools ship working code with predictable security holes. A concrete checklist to harden a vibe-coded Next.js + Supabase SaaS before real users hit it.
AISupabaseNext.jsSecurityRLS - ·4 min read
Do you need a paid security scanner as a solo dev?
When a free security scanner is genuinely enough for a solo dev, and the signals that mean it's time to pay. An honest decision guide, not a sales pitch.
SecurityToolsSolo DevFree Tier - ·6 min read
Free security scanning for a Next.js + Supabase repo (no card)
What GuardLayer's free tier gives you: every push scanned on unlimited public Next.js + Supabase repos, PR comments, a merge-gate check, no credit card.
SecurityNext.jsSupabaseFree Tier - ·9 min read
AI Coding Agents Keep Leaving RLS Off — Catch It Before You Push
Cursor, Lovable, v0 and Claude routinely generate Supabase tables with no RLS — a public-data leak via the anon key. Why it happens and how to catch it.
SupabaseRLSAICursorLovable - ·9 min read
Best Security Scanner for Solo Devs & Indie Hackers (2026)
An honest buyer's guide to security scanners for solo devs, with verified 2026 pricing for Snyk, GitGuardian, Socket, Semgrep, Sonar, and GuardLayer.
SecurityToolsNext.jsSupabase - ·8 min read
The Lovable RLS Vulnerability (CVE-2025-48757), Explained
CVE-2025-48757: AI-built Lovable apps shipped with Supabase RLS off, leaking data to anyone with the anon key. The root cause, the fix, and a self-check.
LovableSupabaseRLSCVEAI - ·8 min read
Is Your Next.js App Leaking Secrets to the Browser?
The three ways a Next.js app leaks secrets client-side — NEXT_PUBLIC_ misuse, server imports, and serialized props — and how to detect and fix each one.
Next.jsSecretsSecurityApp Router - ·8 min read
The Next.js + Supabase Security Checklist
A pre-launch security checklist for Next.js + Supabase apps covering RLS, secrets, the app layer, and dependencies — each item with the why and the fix.
SupabaseNext.jsRLSSecurityChecklist - ·9 min read
The Supabase MCP Lethal Trifecta: How an Agent Reads Your DB
Hand an AI agent the Supabase service_role key over MCP and you build the lethal trifecta. Here's the real risk and the fix that actually holds.
SupabaseMCPAIRLSPrompt Injection - ·8 min read
Vibe-Coding Security: What Goes Wrong in AI-Built Apps
AI tools like Lovable, Bolt and v0 ship Next.js + Supabase apps fast — and with the same handful of holes. Here are the recurring failures and fixes.
Vibe CodingSupabaseRLSNext.jsAI - ·6 min read
Is dangerouslySetInnerHTML safe? When React's escape hatch turns into XSS
dangerouslySetInnerHTML bypasses React's auto-escaping. Here's exactly when it becomes XSS, why the name is a warning, and the precise fix.
ReactXSSNext.jsSecurity