Field notes on Supabase RLS, leaked secrets, and everything that quietly breaks when an AI coding tool ships your app for you.
Lovable can now create a Supabase project from chat. Before you approve it, set the client organization, region, billing owner, roles, and handoff evidence.
GitHub AI Scan adds useful pull-request findings, but it cannot block merges or audit a full repository. Use this agency checklist to verify coverage, triage findings and document the gaps at client handoff.
Some public GitHub clones can temporarily require authentication. Diagnose the actual failure, choose a bounded CI identity, and document a client-owned handoff.
Review Vercel retention before October 23, separate rollback from rebuilding and data recovery, and give clients an evidence-backed recovery record.
Supabase is removing four legacy TLS 1.2 cipher suites. Inventory and verify every supported client before the November 10, 2026 earliest cutoff.
Local sandboxing limits what Copilot tools and commands can reach. Use this agency checklist to configure, test, and document the boundary.
A practical client-handoff guide for Vercel’s Node.js 20 cutoff: find version pins, upgrade reproducibly, test server paths, and verify the deployed runtime.
A practical guide for agencies using Supabase AI tools: choose project scope, verify permission boundaries, and document access before client handoff.
A launch decision needs evidence, not vibes. Here are the seven checks that decide whether an AI-generated app is safe to ship — and what proof each one should produce.
Row-level security is the difference between a private app and a public database. Twelve concrete checks, the SQL to run them, and the mistakes AI code generators make most often.
The service-role key bypasses every access rule you wrote. AI coding tools wire it into client code more often than anyone expects. Here is how to find it, and what to do next.
Lovable ships working apps fast. The security defaults are yours to set. A publish-day checklist covering database rules, keys, edge functions, auth and headers.
Missing security headers are the most common finding in AI-built apps and the cheapest to fix. What each header does, sane starting values, and how to verify them.
AI generates code faster than anyone can read it. A repeatable review method: follow the data, not the diff — trust boundaries, authorisation, secrets and dependencies.
Supabase RLS is one authorization layer, not the only gate. Learn how exposed schemas, grants, policies, USING, WITH CHECK, and the October 30 grant change work together.