Blog
Short notes on what a visitor can already see in a vibe-coded app. Each one ends at the free scan.
2026-10-27
The anon key is not the leak
A Supabase anon key in the browser is expected. A service_role key, Stripe secret, or OpenAI key in the same bundle is not.