Logbook
Short guides to the problems vibe-coded apps most often ship with, and how to fix them by hand.
2026-10-18
Why isn't my vibe-coded app showing up on Google?
Two out of three live vibe-coded apps we checked had at least one problem that makes Google's job harder. Here's how to check yours and fix the common ones with plain prompts.
2026-10-18
How to add security headers to your Lovable, Bolt, or Cursor app
97% of the live vibe-coded apps we checked were missing basic security headers. Here's what they are, how to check yours in one minute, and the prompt that adds them.
2026-10-17
What is an exposed API key, and why does it matter?
A plain-English explanation of API keys, which ones are safe to show, which ones aren't, and what to do if yours leaked.
2026-10-17
We checked 76 live vibe-coded apps. Here's what almost all of them missed.
We ran our free launch check on 76 public apps built with vibe-coding tools. 97% were missing basic browser safety settings. Here's the full breakdown and how to fix each one.
2026-10-17
Supabase security for non-coders
What Supabase is, what Row Level Security means, and how to check that your app's database is locked, explained without jargon.
2026-10-17
Supabase's October 30 change: why new tables may stop showing up in your app
From Oct 30, 2026, new Supabase tables stay hidden from your app until you allow access. What changes, who it hits, and prompts to fix it.
2026-10-17
Is my Lovable app safe to launch?
A plain-English check you can do in 15 minutes before you share your Lovable app with real people. No coding needed.
2026-10-17
How to tell if your vibe-coded app is leaking data
Five simple tests anyone can run to see whether a stranger could read your users' info. No coding knowledge needed.
2026-10-17
Bolt app launch checklist
A step-by-step checklist for launching an app you built with Bolt, written for people who don't code.
2026-09-30
The ship-day checklist for a vibe-coded app
A checklist before you share the URL. Secrets, database rules, headers, HTTPS, rate limits, and the tags that make the link look finished.
2026-09-02
Your client bundle already confessed
NEXT_PUBLIC_ is a publish switch. How Stripe, OpenAI, and AWS keys land in JavaScript every visitor downloads, and how to get them out.
2026-08-12
The anon key is not the secret
Supabase anon keys belong in the browser. service_role keys and a policy of USING (true) do not. Which keys belong in the browser, and how to tell if your tables are open.