Field notes for AI builders
Practical playbooks on shipping, securing, and growing AI-built products — no fluff.
Is Your Lovable App Secure? The Supabase RLS Checklist
Most Lovable apps ship with their Supabase database wide open because Row-Level Security is never enforced — here's how to check for it and lock it down.
Read moreBolt.new put your API keys in the browser — how to fix it
Bolt.new's default is to hardcode secrets into the client bundle, where anyone can read them — here's how to check your app and move every key to the server where it belongs.
Read moreHow to deploy your v0 app to production (and secure its API routes)
v0 gets you to a working preview fast, but its API routes ship unauthenticated by default — here is how to check for the hole, close it, and deploy a real, secured production build.
Read moreReplit Exposed Your .env — Secure Your AI-Built App Before Launch
Replit's default deployments can leave your .env and secrets reachable from the public internet — here's why it happens, how to check, and how to fix it before you ship.
Read moreCursor wrote your API — but who checked the auth? Fixing BOLA
If Cursor built your backend, there's a good chance any logged-in user can read another user's data just by changing an ID in the URL — here's why that BOLA gap ships by default, how to test for it, and how to close it.
Read moreHow to finish an AI-built app stuck on the last 30%
AI gets you 70% of the way in a weekend, then stalls on payments, auth, and deployment. Here's how to close the gap that decides whether you ship.
Read moreHow to make AI-generated code production-ready
Code that runs in a demo is not code that is ready for real users. Here are the gaps between "it works" and "it's production-ready" — and how to close each.
Read moreHow to deploy a vibe-coded app (Lovable, Bolt, v0) to production
Your app works in the builder preview. Going live means a real host, a real database, payments, and a domain. Here is the path from preview to production.
Read moreIs your vibe-coded app secure? A 5-minute checklist
AI writes code fast — and ships vulnerabilities just as fast. Run this checklist before you put real users (and their data) at risk.
Read moreHow to get your first 100 users for an AI-built app
You shipped the MVP in a weekend. Here's the unglamorous playbook for going from zero to your first hundred real users.
Read more