Security fix guides

Short, accurate fixes for the issues we see most in Lovable, Bolt and Cursor apps on Supabase and Firebase. Each guide gives the direct answer, the SQL or code, and how to check it worked.

• Supabase "RLS Disabled in Public" warning: how to fix it
  What Supabase's "RLS Disabled in Public" (lint 0013) error means, the exact SQL to fix it, and how to check your policies actually work.
• Supabase Oct 30, 2026 change: tables no longer auto-exposed to the Data API
  What changes on October 30, 2026 when Supabase stops auto-granting new public tables to the Data API, how to fix 42501 errors safely, and what not to do.
• Supabase service_role key in your frontend: what to do now
  Why a Supabase service_role or secret key in browser code bypasses every RLS policy, how to rotate it, and how to move privileged calls to the server.
• Supabase SECURITY DEFINER functions: the risk and the fix
  Why a SECURITY DEFINER function callable by anon or authenticated can bypass RLS in Supabase, and the SQL to revoke, switch to invoker, or lock it down.
• Firebase rules "allow read, write: if true": how to fix it
  Why Firestore or Realtime Database rules with allow read, write: if true are unsafe in production, and secure owner-based rules you can copy, test and deploy.
• Lovable app exposed API key: how to find and fix it
  How API keys end up in Lovable app code, which Supabase keys are safe to ship, how to move secrets to server-side functions, and how to rotate a leaked key.
• Bolt.new app security checklist before you launch
  A practical pre-launch security checklist for Bolt.new apps on Supabase or Firebase: secrets, RLS, grants, functions, storage, rules and API routes.
• Next.js API route without auth: how to protect it
  Why Next.js Route Handlers and Server Actions must check auth themselves, plus copy-paste code for 401/403 checks and a central verifySession helper.