Fix guides for AI-built apps

Found something with the free check, or worried you might have? Each guide tells you what's at risk, what to fix first, and gives you a prompt to paste into your AI tool.

• Your Supabase service_role key is in your frontend. Here's what to do.

  The service_role key bypasses Row Level Security. If it's in your browser code, anyone can read or delete your database. How to replace it, step by step, for Lovable, Bolt and Next.js apps.

• Is it safe that my Supabase anon key is public?

  The Supabase anon and publishable keys are meant to be public, but only Row Level Security stops them from reading your whole database. How to check every table and add a basic policy.

• Your Stripe secret key is public. Rotate it before anyone uses it.

  A Stripe sk_live key in your frontend lets anyone create charges, issue refunds and read customer data. How to rotate it in the Stripe Dashboard without breaking checkout.

• Your OpenAI API key is in your frontend. Anyone can spend your credits.

  An OpenAI key in browser JavaScript lets anyone run requests on your bill. How to replace the key, move calls to a server, and cap your spending.

• Your .env file can be downloaded from your website.

  If yoursite.com/.env loads, every secret in it is public. How to remove it from your deployment, rotate the keys, and stop it happening again.