Hi, and thanks for signing up.

Fix this week: check which of your keys are really public

Some keys are meant to be in your frontend (Supabase anon key, Firebase web API key, Clerk and Stripe publishable keys). Others must never leave your server (Supabase service role key, OpenAI keys, Stripe and Clerk secret keys, webhook secrets). AI tools mix these up a lot, usually by putting a secret behind a NEXT_PUBLIC_ or VITE_ prefix.

Spend five minutes on this today:

1. Open your .env file and look for any secret with a NEXT_PUBLIC_ or VITE_ prefix.

2. If you find one, rotate it first, then move it to server only code.

3. Run your public repo through our free scanner: https://vibelocked.com/scan (it runs in your browser, no login, nothing uploaded).

New guides

• Supabase anon key vs service role key: https://vibelocked.com/guides/supabase-anon-key-vs-service-role-key/

• Clerk publishable key vs secret key: https://vibelocked.com/guides/clerk-publishable-key-vs-secret-key/

• Is your Firebase API key public? (and why App Check matters): https://vibelocked.com/guides/firebase-api-key-public-app-check/

• The Stripe success page paywall bypass: https://vibelocked.com/guides/stripe-success-page-paywall-bypass/

• Vercel preview deployments and env vars: https://vibelocked.com/guides/vercel-preview-deployments-env-vars/

• Supabase Auth settings to change before launch: https://vibelocked.com/guides/supabase-auth-security-settings/

If a key already leaked

Follow the first hour plan: https://vibelocked.com/guides/first-hour-after-an-api-key-leaks/ . Short version: rotate first, clean up git history later.

Checklist of the week

Supabase RLS checklist: https://vibelocked.com/checklists/supabase-rls-security-checklist/

That’s it for Edition 1. Reply and tell me what you’re building and which tool you use. I read every reply and it shapes what I write next.

VibeLocked

https://vibelocked.com