Vibe Check: demo-app.example

Area: Security
Why it matters: Anyone can open your site's code in their browser and copy this key, then run up bills or reach data in your name.
What we saw: sk-pro…MnOp in https://demo-app.example/assets/index-abc.js

Paste this into your AI builder:

My public frontend code contains an OpenAI API key. Move every call that uses this key into a server-side function (for example a Supabase Edge Function or an API route) that reads the key from an environment variable. Make sure the key no longer appears in any file that ships to the browser. After that I will rotate the key myself.

Area: Security
Why it matters: This key skips every security rule. Anyone who has it can read, change or delete your whole database.
What we saw: eyJhbG…xxxx in https://demo-app.example/assets/index-abc.js

Paste this into your AI builder:

My frontend contains the Supabase service_role key, which bypasses all security. Remove it from all client code immediately. Use only the anon/publishable key in the browser and move admin operations into an Edge Function that reads the service key from secrets.

Area: Security
Why it matters: Files like this often hold passwords, API keys or your full source history.
What we saw: GET /.env returned 200 (contents not stored)

Paste this into your AI builder:

The file /.env is publicly downloadable from my website. Remove it from the published build and stop it from being deployed (add it to .gitignore and the hosting ignore list). If it held any secrets, list which ones so I can rotate them.

Area: Security
Why it matters: On public Wi-Fi, logins and personal data sent over plain http can be read or changed by someone else on the network.
What we saw: http:// answered 200 without redirecting to https

Paste this into your AI builder:

My app must only load over HTTPS. Redirect every http:// request to https:// and enable HSTS. Tell me which setting or file you changed.

Area: Security
Why it matters: These headers tell browsers to block common attacks, such as other sites embedding yours to trick users (clickjacking) or injected scripts.
What we saw: Missing: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy

Paste this into your AI builder:

Add these HTTP security headers to every response of my app: HSTS, Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Use safe defaults (X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, a Content-Security-Policy that allows only my own domain plus the services I actually use). Explain each one in one line.

Area: Privacy
Why it matters: If you collect emails or any user data, GDPR and India's DPDP Act expect you to say what you collect and why. Payment providers also require it.
What we saw: No 'privacy' link in the homepage HTML (apps that render everything in JavaScript may hide it)

Paste this into your AI builder:

Add a Privacy Policy page and a Terms page, linked from the footer. The privacy policy should say what personal data the app collects, why, how long it's kept, which third-party services process it, and how users can request deletion (GDPR and India DPDP basics).

Area: Architecture
Why it matters: Source maps make it easy for anyone to read your full app logic and look for weaknesses.
What we saw: sourceMappingURL references found in public JS

Paste this into your AI builder:

My production build publishes source map (.map) files, which expose my original source code. Turn off production source maps in the build config.

Area: Architecture
Why it matters: Without them, search engines index the wrong pages (sometimes admin screens) and miss the right ones.
What we saw: robots.txt: missing, sitemap.xml: missing

Paste this into your AI builder:

Add a robots.txt and a sitemap.xml to my site. Allow search engines on public pages and disallow /admin, /dashboard and /api.

Area: Security
Why it matters: The public (anon) key is meant to be public, but if any table has RLS switched off or a policy set to `true`, anyone can read every row. This was the cause of the 2025 Lovable data exposures (CVE-2025-48757). A passive scan can't safely confirm it; the paid audit tests it with your permission.
What we saw: Supabase project abcdefghijklmnopqrst referenced in https://demo-app.example/assets/index-abc.js

Paste this into your AI builder:

Go through every table in my Supabase database. Turn on Row Level Security for each one. For tables holding user data, add policies so a signed-in user can only select, insert, update and delete rows where user_id = auth.uid(). Remove any policy that uses `true` for everyone. Don't change the app's features. When you're done, list every table with its policies in a simple table.