[{"data":1,"prerenderedAt":1090},["ShallowReactive",2],{"\u002Fblog\u002Fv0-app-rescue-2026\u002F":3,"\u002Fblog\u002Fv0-app-rescue-2026\u002F-related":371,"\u002Fblog\u002Fv0-app-rescue-2026\u002F-resources":1074},{"id":4,"title":5,"author":6,"body":10,"category":284,"checker":285,"createdAt":286,"description":287,"disclosure":285,"extension":288,"faq":289,"heroActions":285,"howTo":285,"lastVerified":305,"location":306,"meta":307,"navigation":313,"ogImage":285,"path":314,"primaryKeyword":315,"readingTime":316,"related":317,"seo":320,"sources":321,"stem":361,"tags":362,"takeaways":363,"updatedAt":286,"url":369,"__hash__":370},"blog\u002Fblog\u002Fv0-app-rescue-2026.md","v0 App Rescue: 8 Problems to Fix Before Launch",{"name":7,"social":8},"Simon Dziak",{"twitter":9},"@SzymonDziak",{"type":11,"value":12,"toc":270},"minimark",[13,21,24,29,32,55,61,65,68,77,82,86,89,92,101,109,113,116,119,130,135,139,142,145,150,155,159,162,167,172,176,179,184,189,193,196,201,206,210,232,236],[14,15,16,20],"p",{},[17,18,19],"strong",{},"A v0 app is a Next.js app deployed to Vercel, with its data at a provider such as Supabase, Neon or Upstash, so its launch problems are Next.js, Vercel and database problems."," v0's docs say \"v0 deploys projects to Vercel,\" and its database integrations add a separate account with that provider. That's good news in one way: the risks are well documented. It also means the fixes are yours to make. v0's FAQ puts the evaluation on you: \"You are responsible for evaluating any content you generate through v0 and making your own determination about its suitability for commercial or other purposes.\"",[14,22,23],{},"Below are the eight problems to check before launch, how to test each one, and how to fix it. The facts come from v0, Vercel, Next.js and Supabase documentation and security advisories, re-read on October 20, 2026. Plan details change often, so check the current page before you rely on a limit. The how-to-check and how-to-fix steps are my own advice.",[25,26,28],"h2",{"id":27},"_1-unpatched-react-and-nextjs-react2shell","1. Unpatched React and Next.js (React2Shell)",[14,30,31],{},"In December 2025, a critical flaw in React Server Components, CVE-2025-55182 and known as React2Shell, let attackers send crafted requests to server function endpoints. The NVD entry says \"The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.\" Vercel's bulletin named v0 directly: \"you should patch affected v0 apps immediately rather than wait for the automatic update.\" It also notes that \"v0 apps that are not published are unaffected by React2Shell.\"",[14,33,34,37,38,42,43,46,47,50,51,54],{},[17,35,36],{},"How to check:"," open ",[39,40,41],"code",{},"package.json"," in your repository and compare the ",[39,44,45],{},"next",", ",[39,48,49],{},"react"," and ",[39,52,53],{},"react-dom"," versions with the patched versions in Vercel's bulletin.",[14,56,57,60],{},[17,58,59],{},"How to fix:"," upgrade to the patched versions, redeploy, and confirm the live deployment is the new build. Vercel's bulletin says that if your app was online and unpatched as of December 4, 2025, you should rotate any secrets it uses. Keep watching Next.js security advisories, because this won't be the last one.",[25,62,64],{"id":63},"_2-sign-in-checks-only-in-middleware","2. Sign-in checks only in middleware",[14,66,67],{},"In March 2025, CVE-2025-29927 showed that \"it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware.\" The advisory says deployments hosted on Vercel were automatically protected, so this mostly matters if you export the app and host it yourself. The lesson still applies: middleware is a convenient first gate, not the only one.",[14,69,70,72,73,76],{},[17,71,36],{}," find where your app decides who can see a page or call an action. If the only check is in ",[39,74,75],{},"middleware.ts",", that's a single point of failure.",[14,78,79,81],{},[17,80,59],{}," check the user's session again inside each server action, route handler and data query that returns private data, and keep Next.js up to date.",[25,83,85],{"id":84},"_3-secret-keys-that-ship-to-the-browser","3. Secret keys that ship to the browser",[14,87,88],{},"v0's security guide is clear: \"Only variables prefixed with NEXT_PUBLIC_ are exposed to the browser.\" Anything with that prefix ends up in the JavaScript every visitor downloads. A database service key, payment secret or AI API key with that prefix is public.",[14,90,91],{},"There's a second trap: \"The v0 preview window can only access variables from the Development environment.\" An app can work in preview and fail in production because the Production values were never set.",[14,93,94,96,97,100],{},[17,95,36],{}," search your code and your Vercel project settings for ",[39,98,99],{},"NEXT_PUBLIC_"," and read every name. Then compare the Development and Production variable lists in Vercel.",[14,102,103,105,106,108],{},[17,104,59],{}," rename secrets so they have no ",[39,107,99],{}," prefix and read them only on the server. Rotate any key that was ever exposed. Set every Production value before you publish, and set secrets to the Secret type in Vercel, whose values are \"write-only after saving.\"",[25,110,112],{"id":111},"_4-database-rules-nobody-set","4. Database rules nobody set",[14,114,115],{},"v0 doesn't store your data itself. Its docs say \"Adding an integration provisions a new user account on that service and adds the necessary environment variables to your project.\" That makes the access rules on that database your job. v0's database docs don't mention Supabase's row-level security.",[14,117,118],{},"If you use Supabase, Supabase's own docs warn: \"A table in an exposed schema without RLS is readable and writable by any role with a grant on it.\" The service role key \"bypasses RLS, so keep it server-side.\"",[14,120,121,123,124,129],{},[17,122,36],{}," on Supabase, run the free ",[125,126,128],"a",{"href":127},"\u002Ftools\u002Fsupabase-oct-30-checker\u002F#leak-scan","leak scan"," against your live site and open Supabase's Security Advisor. On Neon, Upstash or Vercel Blob, confirm that every query and token is used only in server code.",[14,131,132,134],{},[17,133,59],{}," turn on row-level security for every Supabase table and write a policy for each action. Keep the service role key and any database connection string on the server only.",[25,136,138],{"id":137},"_5-version-history-that-doesnt-cover-everything","5. Version history that doesn't cover everything",[14,140,141],{},"v0's versions guide says \"Non-message actions (such as editing code or modifying files directly) do not generate new versions.\" If you edit code by hand in v0, there may be no version to go back to.",[14,143,144],{},"A Vercel rollback has limits too. Vercel says it \"won't update environment variables if you change them in the project settings and will roll back to a previous build.\" A rollback restores the build, not your database, and on the Hobby plan you can only go back to the deployment just before the current one.",[14,146,147,149],{},[17,148,36],{}," confirm GitHub is connected and that recent hand edits appear as commits. Find out what plan you're on and how far back you can roll back.",[14,151,152,154],{},[17,153,59],{}," treat GitHub as the real history. Back up your database before schema changes, because no code rollback will undo them.",[25,156,158],{"id":157},"_6-the-github-repository-is-the-source-of-truth","6. The GitHub repository is the source of truth",[14,160,161],{},"Once you connect GitHub, the repository holds your code. v0 warns: \"If you delete the repository, the code may become unrecoverable.\" Publishing can also go through pull requests, so branch protection rules on the repository can slow down an urgent fix.",[14,163,164,166],{},[17,165,36],{}," confirm who owns the repository, who has admin access, and whether branch protection would block a hotfix.",[14,168,169,171],{},[17,170,59],{}," keep the repository under an account you control, add a second admin you trust, and practice one small fix from edit to live before launch day.",[25,173,175],{"id":174},"_7-credits-that-run-out-mid-fix","7. Credits that run out mid-fix",[14,177,178],{},"v0 runs on credits. \"When credits are used up, generation pauses.\" Unused monthly credits \"roll over to the next billing cycle and expire after 65 days.\" Automatic fixes are only partly free: \"On paid plans, you get up to 10 free uses per day on unedited code; after that, fixes cost credits like a normal prompt.\"",[14,180,181,183],{},[17,182,36],{}," look at your credit balance and recent usage, and know what you would do if credits ran out during an outage.",[14,185,186,188],{},[17,187,59],{}," make sure you or a developer can change the code directly in GitHub, so an urgent fix never waits for credits.",[25,190,192],{"id":191},"_8-team-and-plan-changes-with-side-effects","8. Team and plan changes with side effects",[14,194,195],{},"Plan changes can do more than change the price. v0's Vercel integration guide warns that \"downgrading from Pro to Hobby will kick all other members from the team.\" If the account owner downgrades to save money, collaborators can lose access at the worst moment.",[14,197,198,200],{},[17,199,36],{}," list who is on your Vercel team, who owns the account, and which plan each project is on.",[14,202,203,205],{},[17,204,59],{}," keep the production project on a team you control, and check the team list after any plan change.",[25,207,209],{"id":208},"what-to-do-this-week","What to do this week",[211,212,213,217,223,226,229],"ol",{},[214,215,216],"li",{},"Check your Next.js and React versions against Vercel's React2Shell bulletin and redeploy.",[214,218,219,220,222],{},"Search for ",[39,221,99],{}," and move every secret to the server.",[214,224,225],{},"Set every Production variable in Vercel before you publish.",[214,227,228],{},"If you use Supabase, run the leak scan and turn on row-level security everywhere.",[214,230,231],{},"Connect GitHub and back up your database before launch day.",[25,233,235],{"id":234},"need-a-hand","Need a hand?",[14,237,238,239,243,244,46,248,46,252,46,256,50,260,264,265,269],{},"If you'd rather have someone else check it, the ",[125,240,242],{"href":241},"\u002Ffixed-price\u002Fai-app-rescue\u002F","AI-Built App Rescue"," starts with a $450 Launch Check. You send read-only access, and within 3 business days you get each problem ranked by severity, with where it is and how it was confirmed, plus a fixed price for the Rescue Sprint. The $450 is credited if you go ahead, and you keep the code either way. Built with something else? See the ",[125,245,247],{"href":246},"\u002Fblog\u002Flovable-app-rescue-2026\u002F","Lovable",[125,249,251],{"href":250},"\u002Fblog\u002Fbolt-app-rescue-2026\u002F","Bolt",[125,253,255],{"href":254},"\u002Fblog\u002Freplit-app-rescue-2026\u002F","Replit",[125,257,259],{"href":258},"\u002Fblog\u002Fcursor-app-rescue-2026\u002F","Cursor",[125,261,263],{"href":262},"\u002Fblog\u002Fbase44-app-rescue-2026\u002F","Base44"," checklists. Or ",[125,266,268],{"href":267},"\u002Fcontact\u002F","send me a short description",".",{"title":271,"searchDepth":272,"depth":272,"links":273},"",2,[274,275,276,277,278,279,280,281,282,283],{"id":27,"depth":272,"text":28},{"id":63,"depth":272,"text":64},{"id":84,"depth":272,"text":85},{"id":111,"depth":272,"text":112},{"id":137,"depth":272,"text":138},{"id":157,"depth":272,"text":158},{"id":174,"depth":272,"text":175},{"id":191,"depth":272,"text":192},{"id":208,"depth":272,"text":209},{"id":234,"depth":272,"text":235},"AI & Technology",null,"2026-10-20T16:00:00.000Z","Your v0 app is a Next.js app running on Vercel, with data in Supabase, Neon or another provider. The 8 problems to check before launch, from the React2Shell patch and browser-exposed keys to database rules and rollbacks, with how to test and fix each one.","md",[290,293,296,299,302],{"question":291,"answer":292},"Is v0 secure?","v0 apps are Next.js apps hosted on Vercel, so their security depends on keeping Next.js and React patched, keeping secret keys out of the browser, and setting the database rules yourself. v0's FAQ says you are responsible for judging whether what it generates is suitable for your use.",{"question":294,"answer":295},"Was my v0 app affected by React2Shell?","Vercel's bulletin says published v0 apps on affected React and Next.js versions needed patching, and that unpublished v0 apps were not affected. Check the versions in your repository and redeploy if they are older than the patched releases.",{"question":297,"answer":298},"Why does my v0 app work in preview but not in production?","The v0 preview window only reads variables from the Development environment. Set the same keys for Production in your Vercel project before you publish.",{"question":300,"answer":301},"Does the free Supabase leak scan work for v0 apps?","Yes, if your v0 app uses Supabase. If it uses Neon, Upstash or Vercel Blob, the scan does not apply; check instead that no database query or token can be reached from the browser.",{"question":303,"answer":304},"Can I move my v0 app off Vercel?","Yes. v0's FAQ says you can export the code and deploy elsewhere. Self-hosting means you handle Next.js patches yourself, because some protections Vercel adds automatically will not be there.","2026-10-20","Boynton Beach, FL",{"readingTimeStats":308},{"text":309,"minutes":310,"time":311,"words":312},"7 min read",6.55,393000,1310,true,"\u002Fblog\u002Fv0-app-rescue-2026","v0 app rescue","8 min",[318,319],"cursor-app-rescue-2026","lovable-app-rescue-2026",{"title":5,"description":287},[322,325,328,331,334,337,340,343,346,349,352,355,358],{"title":323,"url":324},"Vercel, React2Shell security bulletin","https:\u002F\u002Fvercel.com\u002Fkb\u002Fbulletin\u002Freact2shell",{"title":326,"url":327},"NVD, CVE-2025-55182","https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-55182",{"title":329,"url":330},"GitHub advisory GHSA-f82v-jwr5-mffw (CVE-2025-29927, Next.js middleware)","https:\u002F\u002Fgithub.com\u002Fvercel\u002Fnext.js\u002Fsecurity\u002Fadvisories\u002FGHSA-f82v-jwr5-mffw",{"title":332,"url":333},"v0 docs, Security","https:\u002F\u002Fv0.app\u002Fdocs\u002Fsecurity",{"title":335,"url":336},"v0 docs, Vercel integration","https:\u002F\u002Fv0.app\u002Fdocs\u002Fvercel-integration",{"title":338,"url":339},"v0 docs, Databases","https:\u002F\u002Fv0.app\u002Fdocs\u002Fdatabases",{"title":341,"url":342},"v0 docs, Versions","https:\u002F\u002Fv0.app\u002Fdocs\u002Fversions",{"title":344,"url":345},"v0 docs, GitHub","https:\u002F\u002Fv0.app\u002Fdocs\u002Fgithub",{"title":347,"url":348},"v0 docs, Pricing","https:\u002F\u002Fv0.app\u002Fdocs\u002Fpricing",{"title":350,"url":351},"v0 docs, FAQs","https:\u002F\u002Fv0.app\u002Fdocs\u002Ffaqs",{"title":353,"url":354},"Vercel docs, Instant Rollback","https:\u002F\u002Fvercel.com\u002Fdocs\u002Finstant-rollback",{"title":356,"url":357},"Vercel docs, Sensitive environment variables","https:\u002F\u002Fvercel.com\u002Fdocs\u002Fenvironment-variables\u002Fsensitive-environment-variables",{"title":359,"url":360},"Supabase docs, Row Level Security","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fpostgres\u002Frow-level-security","blog\u002Fv0-app-rescue-2026","v0 app rescue, fix v0 app, v0 security, v0 vercel deploy, v0 supabase, react2shell, ai app rescue, vibe coded app",[364,365,366,367,368],"A published v0 app is a Next.js app deployed to Vercel, so Next.js and Vercel security advisories apply to it.","Vercel's React2Shell bulletin told owners to \"patch affected v0 apps immediately rather than wait for the automatic update.\"","v0's security guide says \"Only variables prefixed with NEXT_PUBLIC_ are exposed to the browser\", so a secret key with that prefix is public.","Your data lives with a provider such as Supabase or Neon, and the access rules on it are yours to set.","In v0, \"Non-message actions (such as editing code or modifying files directly) do not generate new versions\", and a Vercel rollback restores code, not data.","https:\u002F\u002Fapp369.com\u002Fblog\u002Fv0-app-rescue-2026\u002F","Yih1UL7DoARw6OM_dlOqofeNoo4xgcZ-G0a_OeQtCnI",[372,734],{"id":373,"title":374,"author":375,"body":377,"category":284,"checker":654,"createdAt":655,"description":656,"disclosure":285,"extension":288,"faq":657,"heroActions":285,"howTo":285,"lastVerified":305,"location":306,"meta":673,"navigation":313,"ogImage":285,"path":678,"primaryKeyword":679,"readingTime":680,"related":681,"seo":684,"sources":685,"stem":724,"tags":725,"takeaways":726,"updatedAt":655,"url":732,"__hash__":733},"blog\u002Fblog\u002Fcursor-app-rescue-2026.md","Cursor App Rescue: 7 Problems to Fix Before Launch",{"name":7,"social":376},{"twitter":9},{"type":11,"value":378,"toc":643},[379,385,388,392,398,413,431,436,440,443,452,457,461,468,471,484,498,502,505,517,522,526,529,534,539,543,552,561,566,570,586,595,600,602,622,624],[14,380,381,384],{},[17,382,383],{},"Cursor writes code in your own repository, so the problems that show up with real users are ordinary web app problems that are easy to miss without a review: secret keys, unprotected endpoints, open database rules, unchecked packages and settings that differ between your machine and the host."," Unlike Lovable, Bolt or Replit, Cursor doesn't host your app or pick your database. That gives you more control, and it also means no platform check runs before you launch.",[14,386,387],{},"Below are the seven problems to check before launch, how to test each one, and how to fix it. The facts come from Cursor's documentation and forum, the Next.js, Vercel, Supabase and Firebase docs, OWASP, NVD and one research paper, and I re-read each source on October 20, 2026. The examples use Next.js, but the checks apply to any stack. The how-to-check and how-to-fix steps are my own advice.",[25,389,391],{"id":390},"_1-secret-keys-in-the-browser-or-in-git","1. Secret keys in the browser or in git",[14,393,394,395,397],{},"In Next.js, a variable whose name starts with ",[39,396,99],{}," \"will be inlined into any JavaScript sent to the browser.\" If the agent puts a secret there to make a feature work, every visitor can read it. Supabase is blunt about its secret keys: \"A secret key bypasses every Row Level Security policy you have. Never put one in a browser, a shipped application, or source control.\"",[14,399,400,401,404,405,408,409,412],{},"Cursor can also read your ",[39,402,403],{},".env"," file. A Cursor staff reply on its forum explains that ",[39,406,407],{},".env*"," is in the default ignore list, \"but that list only applies to indexing\", and Cursor's docs say the terminal and MCP tools used by the Agent \"cannot block access to code governed by ",[39,410,411],{},".cursorignore","\".",[14,414,415,417,418,46,421,46,424,427,428,430],{},[17,416,36],{}," search the code and the git history for ",[39,419,420],{},"service_role",[39,422,423],{},"sb_secret_",[39,425,426],{},"sk_live"," and your providers' key prefixes. List every ",[39,429,99],{}," variable and ask whether each one is safe to publish. Open the JavaScript your live site loads and search it for the same prefixes.",[14,432,433,435],{},[17,434,59],{}," rotate every key that was ever in browser code or git, move secrets to server-only code and the host's environment settings, and keep production secrets out of the project folder.",[25,437,439],{"id":438},"_2-api-routes-and-server-actions-anyone-can-call","2. API routes and server actions anyone can call",[14,441,442],{},"Hiding a button doesn't protect the action behind it. The Next.js data security guide says a Server Action \"is reachable via a direct POST request, not just through your application's UI,\" and that \"A page-level authentication check does not extend to the Server Actions defined within it.\" OWASP calls the related flaw insecure direct object reference (IDOR): attackers \"access or modify objects by manipulating identifiers\", such as changing an ID in a request to read another user's record.",[14,444,445,447,448,451],{},[17,446,36],{}," for every API route and every ",[39,449,450],{},"'use server'"," function, confirm it checks the session and that the record belongs to that user. Call each one while logged out, then as user B with user A's IDs.",[14,453,454,456],{},[17,455,59],{}," check authentication and ownership inside each handler, or in one server-only data layer that every handler uses. Return only the fields the screen needs, and deny by default.",[25,458,460],{"id":459},"_3-database-rules-left-wide-open","3. Database rules left wide open",[14,462,463,464,467],{},"If the browser talks to the database directly, the rules are the only thing standing between a stranger and your data. Supabase says: \"Enable RLS on every table in an exposed schema.\" Firebase's own example of an open rule set carries the warning \"",[17,465,466],{},"NEVER"," use this rule set in production; it allows anyone to overwrite your entire database,\" and says that without authentication and rules, \"anyone who guesses your project ID can steal, modify, or delete the data.\"",[14,469,470],{},"A quick way to make a permission error go away during development is to turn row-level security off or add a rule that lets everyone in. That shortcut is easy to forget before launch.",[14,472,473,475,476,479,480,483],{},[17,474,36],{}," on Supabase, open the Security Advisor and search your policies for ",[39,477,478],{},"using ( true )",". On Firebase, search your rules for ",[39,481,482],{},"if true"," and for test-mode dates. Then read and write as a logged-out visitor and as a second user. If your app uses Supabase from the browser, the free scan at the end of this page does the logged-out read test for you.",[14,485,486,488,489,492,493,497],{},[17,487,59],{}," turn on RLS for every exposed table with policies tied to the signed-in user, write Firebase rules that check ",[39,490,491],{},"request.auth",", and keep secret or admin keys on the server. The ",[125,494,496],{"href":495},"\u002Fblog\u002Ffirebase-security-guide-2026\u002F","Firebase security guide"," has worked examples.",[25,499,501],{"id":500},"_4-packages-that-dont-exist-or-arent-what-they-seem","4. Packages that don't exist, or aren't what they seem",[14,503,504],{},"Code models sometimes suggest packages that were never published. A 2024 study of 16 code models found \"the average percentage of hallucinated packages is at least 5.2% for commercial models and 21.7% for open-source models.\" Those figures cover models in general, not Cursor in particular. The risk is that someone registers an invented name with harmful code, and the next install pulls it in.",[14,506,507,509,510,512,513,516],{},[17,508,36],{}," read every new line in ",[39,511,41],{}," or ",[39,514,515],{},"requirements.txt",". Confirm each package exists on its registry, has a real history and the publisher you expect. Run your package manager's audit and commit the lockfile.",[14,518,519,521],{},[17,520,59],{}," remove anything you can't account for, install only after checking the registry, and read what the Agent wants to install before you approve it, and don't rely on Cursor's approval prompts alone.",[25,523,525],{"id":524},"_5-big-edits-that-look-right-and-arent","5. Big edits that look right and aren't",[14,527,528],{},"Cursor's own guide to reviewing agent code says \"AI-generated code can look correct but be subtly wrong,\" and \"Passing tests don't guarantee the code works correctly,\" because the tests may check the wrong behavior. It recommends small commits, each one a single logical change, so a person can review them.",[14,530,531,533],{},[17,532,36],{}," read the full diff before you accept it, then run the main user flows by hand: sign-up, sign-in, payment and anything that writes data. Look at which tests cover sign-in, payments and data changes.",[14,535,536,538],{},[17,537,59],{}," ask for one change at a time, commit small, and add tests for the money, login and data paths. Test with a second account and realistic data, not only the demo user.",[25,540,542],{"id":541},"_6-works-locally-fails-on-the-host","6. Works locally, fails on the host",[14,544,545,546,548,549,551],{},"The ",[39,547,403],{}," file on your machine is not on your host. In Next.js, ",[39,550,99],{}," values are fixed when the app is built: \"After being built, your app will no longer respond to changes to these environment variables.\" Vercel adds that \"Any change you make to environment variables are not applied to previous deployments, they only apply to new deployments.\"",[14,553,554,556,557,560],{},[17,555,36],{}," list every ",[39,558,559],{},"process.env"," value the code reads and confirm each one is set on the host for production and for previews. Check whether any were added after the last deploy.",[14,562,563,565],{},[17,564,59],{}," set every variable on the host, redeploy, read server-only values only on the server, and add a startup check that fails loudly when a required value is missing.",[25,567,569],{"id":568},"_7-an-out-of-date-editor-and-unknown-mcp-servers","7. An out-of-date editor and unknown MCP servers",[14,571,572,573,579,580,585],{},"The editor itself is part of the risk. NVD lists ",[125,574,578],{"href":575,"rel":576},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-54136",[577],"nofollow","CVE-2025-54136",", where in Cursor \"versions 1.2.4 and below, attackers can achieve remote and persistent code execution\" by swapping an already-approved MCP configuration for a malicious command (fixed in 1.3), and ",[125,581,584],{"href":582,"rel":583},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-64109",[577],"CVE-2025-64109",", where opening a cloned repository in the Cursor CLI Beta could run a malicious MCP server \"without any warning\". Cursor's security page also says \"Cursor supports workspace trust, but it's disabled by default,\" and calls its run controls \"best-effort guardrails rather than a hard security boundary.\"",[14,587,588,590,591,594],{},[17,589,36],{}," confirm Cursor is on the current version, open ",[39,592,593],{},".cursor\u002Fmcp.json"," in any repository you cloned, and list the MCP servers you have approved.",[14,596,597,599],{},[17,598,59],{}," update Cursor, remove MCP servers you don't recognize, turn on workspace trust, and open repositories you don't trust in a plain text editor first.",[25,601,209],{"id":208},[211,603,604,607,610,613,616],{},[214,605,606],{},"Search the code, git history and live JavaScript for secret keys, and rotate anything you find.",[214,608,609],{},"Call every API route and server action while logged out and as a second user.",[214,611,612],{},"Check your database rules, or run the free leak scan below if your app uses Supabase.",[214,614,615],{},"Check every package added in the last month against its registry.",[214,617,618,619,621],{},"Compare the host's environment variables with your local ",[39,620,403],{},", then redeploy.",[25,623,235],{"id":234},[14,625,238,626,628,629,46,631,46,633,46,635,50,637,264,641,269],{},[125,627,242],{"href":241}," starts with a $450 Launch Check. You send read-only access, and within 3 business days you get each problem ranked by severity, with where it is and how it was confirmed, plus a fixed price for the Rescue Sprint. The $450 is credited if you go ahead, and you keep the code either way. Built with an app builder instead? See the ",[125,630,247],{"href":246},[125,632,251],{"href":250},[125,634,255],{"href":254},[125,636,263],{"href":262},[125,638,640],{"href":639},"\u002Fblog\u002Fv0-app-rescue-2026\u002F","v0",[125,642,268],{"href":267},{"title":271,"searchDepth":272,"depth":272,"links":644},[645,646,647,648,649,650,651,652,653],{"id":390,"depth":272,"text":391},{"id":438,"depth":272,"text":439},{"id":459,"depth":272,"text":460},{"id":500,"depth":272,"text":501},{"id":524,"depth":272,"text":525},{"id":541,"depth":272,"text":542},{"id":568,"depth":272,"text":569},{"id":208,"depth":272,"text":209},{"id":234,"depth":272,"text":235},"supabase-leak-scan","2026-10-20T12:00:00.000Z","Your app was built with Cursor and works on your machine, but real users are coming. The 7 problems to check first, from secret keys and unprotected API routes to open database rules and invented packages, with how to test and fix each one.",[658,661,664,667,670],{"question":659,"answer":660},"Is code written by Cursor safe to launch?","It can be, once a person has reviewed it. Cursor itself says AI-generated code can look correct but be subtly wrong, and that passing tests do not prove it works. Review the diff, test the main flows by hand and test access with two accounts.",{"question":662,"answer":663},"Can Cursor read my .env file?","It can. A Cursor staff reply on its forum says the default ignore list only applies to indexing, not to Agent tool calls, and Cursor's docs say the terminal and MCP tools cannot block access to files in .cursorignore. Keep production secrets out of the project folder.",{"question":665,"answer":666},"Why does my Cursor app work locally but not after deploying?","Usually because an environment variable exists in your local .env file but not on the host, or was set after the last build. In Next.js, NEXT_PUBLIC_ values are fixed at build time, and on Vercel a variable change only applies to new deployments, so redeploy after changing one.",{"question":668,"answer":669},"Does the free leak scan work for apps built with Cursor?","Only if the app uses Supabase from the browser. The scan checks the public Supabase key your live site ships. For Firebase, a custom backend or server-only data access, use the two-account and logged-out tests on this page instead.",{"question":671,"answer":672},"Do I keep my code if I hire someone to fix my Cursor app?","Yes. A Cursor project is ordinary code in your own repository, so a developer works from that repository and you keep everything.",{"readingTimeStats":674},{"text":309,"minutes":675,"time":676,"words":677},6.965,417900,1393,"\u002Fblog\u002Fcursor-app-rescue-2026","cursor app rescue","9 min",[682,683],"replit-app-rescue-2026","firebase-security-guide-2026",{"title":374,"description":656},[686,689,692,695,698,701,704,707,710,711,714,717,720,722],{"title":687,"url":688},"Cursor docs, Reviewing agent code","https:\u002F\u002Fcursor.com\u002Fdocs\u002Fagent\u002Freview",{"title":690,"url":691},"Cursor docs, Agent security","https:\u002F\u002Fcursor.com\u002Fdocs\u002Fagent\u002Fsecurity",{"title":693,"url":694},"Cursor docs, Ignore files","https:\u002F\u002Fcursor.com\u002Fdocs\u002Fcontext\u002Fignore-files",{"title":696,"url":697},"Cursor forum, Cursor reads .env files by default","https:\u002F\u002Fforum.cursor.com\u002Ft\u002Fcursor-reads-env-files-by-default\u002F152167",{"title":699,"url":700},"Next.js docs, Data security","https:\u002F\u002Fnextjs.org\u002Fdocs\u002Fapp\u002Fguides\u002Fdata-security",{"title":702,"url":703},"Next.js docs, Environment variables","https:\u002F\u002Fnextjs.org\u002Fdocs\u002Fapp\u002Fguides\u002Fenvironment-variables",{"title":705,"url":706},"Vercel docs, Environment variables","https:\u002F\u002Fvercel.com\u002Fdocs\u002Fenvironment-variables",{"title":708,"url":709},"OWASP, Insecure Direct Object Reference Prevention Cheat Sheet","https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FInsecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",{"title":359,"url":360},{"title":712,"url":713},"Supabase docs, API keys","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fapi\u002Fapi-keys",{"title":715,"url":716},"Firebase docs, Avoid insecure rules","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffirestore\u002Fsecurity\u002Finsecure-rules",{"title":718,"url":719},"Spracklen et al., We Have a Package for You! (arXiv 2406.10279)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2406.10279",{"title":721,"url":575},"NVD, CVE-2025-54136",{"title":723,"url":582},"NVD, CVE-2025-64109","blog\u002Fcursor-app-rescue-2026","cursor app rescue, fix cursor app, cursor ai code review, cursor security, next.js server actions security, supabase row level security, firebase security rules, ai app rescue, vibe coded app",[727,728,729,730,731],"Cursor's own review guide warns that \"AI-generated code can look correct but be subtly wrong,\" and that \"Passing tests don't guarantee the code works correctly.\"","In Next.js, \"A page-level authentication check does not extend to the Server Actions defined within it,\" so every action and API route has to check the user itself.","Any variable starting with NEXT_PUBLIC_ \"will be inlined into any JavaScript sent to the browser,\" so a secret key there is public.","A 2024 study found at least 5.2% of packages suggested by commercial models, and 21.7% by open-source models, did not exist. Check every new dependency before you install it.","Cursor's workspace trust is \"disabled by default\", and older Cursor versions had MCP flaws that allowed code to run on your machine, so keep Cursor updated.","https:\u002F\u002Fapp369.com\u002Fblog\u002Fcursor-app-rescue-2026\u002F","tm67SK9Xuh8DwiyBxKWstOudaGhnCaKnUixkgo3_F8U",{"id":735,"title":736,"author":737,"body":739,"category":284,"checker":654,"createdAt":1006,"description":1007,"disclosure":285,"extension":288,"faq":1008,"heroActions":285,"howTo":285,"lastVerified":305,"location":306,"meta":1024,"navigation":313,"ogImage":285,"path":1029,"primaryKeyword":1030,"readingTime":316,"related":1031,"seo":1033,"sources":1034,"stem":1064,"tags":1065,"takeaways":1066,"updatedAt":1006,"url":1072,"__hash__":1073},"blog\u002Fblog\u002Flovable-app-rescue-2026.md","Lovable App Rescue: 7 Problems to Fix Before Launch",{"name":7,"social":738},{"twitter":9},{"type":11,"value":740,"toc":995},[741,747,750,754,761,776,781,790,794,797,802,807,811,817,829,834,838,845,858,863,867,870,875,892,896,899,902,917,922,926,929,950,953,958,960,977,979],[14,742,743,746],{},[17,744,745],{},"Problems with real Lovable apps often show up in the same few places: database access rules, keys in the browser, server functions that don't check the caller, and the gap between the preview and the live app."," A Lovable app is a React front end that talks to a Supabase database, either Lovable Cloud (which Lovable says uses \"Supabase's open-source foundation\") or a Supabase project you connect. The browser calls the database directly with a public key, so the database rules are what keep one user's data away from another.",[14,748,749],{},"Below are the seven problems to check before launch, how to test each one in a few minutes, and how to fix it. The facts below come from Lovable's and Supabase's own documentation and from the public security report on Lovable apps, and I re-read each source on October 20, 2026. The how-to-check and how-to-fix steps are my own advice.",[25,751,753],{"id":752},"_1-tables-anyone-can-read-or-change","1. Tables anyone can read or change",[14,755,756,757,760],{},"Lovable's Supabase guide is blunt: \"Missing RLS policies are the most common way app data gets exposed.\" A table in the public schema with row-level security (RLS) turned off, or with a policy like ",[39,758,759],{},"USING (true)",", can be read, and often changed, by anyone who has your app's public key. That key ships in your site's JavaScript by design.",[14,762,763,764,769,770,775],{},"This is not a hypothetical. ",[125,765,768],{"href":766,"rel":767},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48757",[577],"CVE-2025-48757"," describes \"an insufficient database Row-Level Security policy in Lovable through 2025-04-15\" that, per the CVE text, allows unauthenticated attackers to read or write tables of generated sites. The entry is marked as disputed by Lovable, because each customer is responsible for protecting their own app's data. The researchers who filed it ",[125,771,774],{"href":772,"rel":773},"https:\u002F\u002Fmattpalmer.io\u002Fposts\u002Fstatement-on-CVE-2025-48757\u002F",[577],"report"," that their own March 2025 scan, which predates Lovable's current Quick and Deep scans, found 303 endpoints across 170 projects, about 10.3% of the 1,645 they analyzed, with inadequate RLS settings.",[14,777,778,780],{},[17,779,36],{}," open Supabase's Security Advisor and look for \"RLS disabled in public\" and \"policy exists, RLS disabled\". Then request each table with only the public key and no login. The free scan at the end of this page does that for you.",[14,782,783,785,786,789],{},[17,784,59],{}," turn on RLS for every table in the public schema and write policies that tie rows to ",[39,787,788],{},"auth.uid()",". Remove any policy that lets everyone in.",[25,791,793],{"id":792},"_2-a-green-scan-with-the-wrong-policies","2. A green scan with the wrong policies",[14,795,796],{},"Lovable's Quick scan \"runs automatically every time you publish\" and checks things like tables without RLS. A table can have a policy and still let the wrong people in. The CVE researchers said in 2025 that the scanner they tested only checked that a policy existed, \"not its correctness\". Lovable's current Quick scan reviews database access rules, for example tables without per-record access control, but it is still a fixed set of checks. Lovable itself says its tools \"cannot guarantee complete security\".",[14,798,799,801],{},[17,800,36],{}," Lovable's own best-practice guide says to \"sign in as a second user and confirm you cannot see or change the first user's data.\" Do that for every screen that shows private data, and repeat it for each role your app has.",[14,803,804,806],{},[17,805,59],{}," rewrite any policy that fails the two-user test, then test reads, inserts, updates and deletes separately. A policy that blocks reads can still allow writes.",[25,808,810],{"id":809},"_3-secret-keys-in-the-browser","3. Secret keys in the browser",[14,812,813,814,816],{},"Lovable's security docs explain that it \"generates frontend code that runs in the browser, which means API keys and other secrets cannot be stored safely in client-side code.\" Supabase says the same about its secret and ",[39,815,420],{}," keys: never put one in a browser, a shipped app or source control. Stripe secret keys, AI provider keys and admin keys belong in the same category.",[14,818,819,821,822,46,824,46,826,828],{},[17,820,36],{}," search your GitHub repository and the built JavaScript for ",[39,823,420],{},[39,825,423],{},[39,827,426],{}," and your providers' key prefixes.",[14,830,831,833],{},[17,832,59],{}," rotate any secret that was ever exposed, then move the call into a server function that reads the key from Lovable's Secrets. Only the publishable or anon key belongs in the browser.",[25,835,837],{"id":836},"_4-server-functions-that-dont-check-who-is-calling","4. Server functions that don't check who is calling",[14,839,840,841,844],{},"Payments, emails, AI calls and admin actions usually run in Supabase Edge Functions that Lovable writes for you. A function that uses the service key skips RLS entirely, so it has to check the caller itself. Supabase's default is ",[39,842,843],{},"verify_jwt = true",", so \"the platform validates the JWT before your handler runs\", and it warns against turning that off just to clear an error.",[14,846,847,849,850,853,854,857],{},[17,848,36],{}," call each function with no token, then with a normal user's token for an action only an admin should take. Look for ",[39,851,852],{},"verify_jwt = false"," in ",[39,855,856],{},"supabase\u002Fconfig.toml",". Lovable's Deep scan reviews this kind of access control in your code, but \"the Deep scan does not run automatically\", so run it yourself.",[14,859,860,862],{},[17,861,59],{}," keep JWT verification on for anything a user triggers, check the user's role and ownership inside the function, and verify webhook signatures for calls from Stripe or other services.",[25,864,866],{"id":865},"_5-views-and-storage-that-skip-your-rules","5. Views and storage that skip your rules",[14,868,869],{},"Locking down a table is not enough if a view or a storage bucket exposes the same data. Supabase's advisor warns that a security definer view \"runs with elevated privileges and ignores Row-Level Security\". Files in a public storage bucket can be opened by anyone with the link.",[14,871,872,874],{},[17,873,36],{}," in the Security Advisor, look for \"security definer view\" and \"auth users exposed\". In Storage, list which buckets are public.",[14,876,877,879,880,883,884,887,888,891],{},[17,878,59],{}," recreate views with ",[39,881,882],{},"security_invoker = on",", copy the user fields you need into a ",[39,885,886],{},"profiles"," table instead of exposing ",[39,889,890],{},"auth.users",", and make buckets with private files private, with storage policies.",[25,893,895],{"id":894},"_6-the-supabase-october-30-2026-change","6. The Supabase October 30, 2026 change",[14,897,898],{},"Supabase has made \"no automatic grants\" the default for new projects since May 30, 2026, and applies it to all existing projects on October 30, 2026. Once it applies to your project, a new table in the public schema fails with \"permission denied for table\" until a migration grants it. Supabase also says \"existing tables are not affected\", so a table that is open today stays open.",[14,900,901],{},"If your Lovable app uses a Supabase project you own, the change applies. Lovable's docs don't say whether Lovable Cloud follows the same default or adds grants to the migrations it writes, so after October 30, create a test table and check it from the app.",[14,903,904,906,907,911,912,916],{},[17,905,36],{}," paste your migrations into the free ",[125,908,910],{"href":909},"\u002Ftools\u002Fsupabase-oct-30-checker\u002F","Supabase October 30 grants checker",". The ",[125,913,915],{"href":914},"\u002Fblog\u002Fsupabase-permission-denied-new-tables-october-30-2026\u002F","full guide to the change"," has the exact grant lines.",[14,918,919,921],{},[17,920,59],{}," add a grant per role in the same migration that creates each table, next to RLS and its policies.",[25,923,925],{"id":924},"_7-no-safe-path-between-the-preview-and-production","7. No safe path between the preview and production",[14,927,928],{},"Three facts from Lovable's docs catch teams out once real users arrive:",[930,931,932,938,944],"ul",{},[214,933,934,937],{},[17,935,936],{},"Reverting doesn't undo data changes."," Lovable's guide says \"reverting restores your code, not your database data\". A bad migration or a test that wrote to the live database stays in the database.",[214,939,940,943],{},[17,941,942],{},"The live site is a snapshot."," It only changes when you publish again, so the preview and the live app can drift apart.",[214,945,946,949],{},[17,947,948],{},"GitHub sync has limits."," \"Lovable only edits and syncs one branch at a time\", and \"Git sync always creates a new repository\", so you can't attach a project to an existing repository. Two people, or Lovable and a local editor, pushing to the same branch can overwrite each other's work.",[14,951,952],{},"Moving off Lovable Cloud is possible but manual, and removing Cloud \"permanently deletes your Cloud instance and cannot be undone\", so export your database and files first.",[14,954,955,957],{},[17,956,59],{}," export and test a database backup before launch, keep schema changes in migrations in the repository, agree who pushes to the synced branch, and run payments in test mode until the two-user test passes.",[25,959,209],{"id":208},[211,961,962,965,968,971,974],{},[214,963,964],{},"Run the free leak scan below against your live site.",[214,966,967],{},"Do the two-user test on every page with private data.",[214,969,970],{},"Search your repository for secret keys and rotate anything you find.",[214,972,973],{},"Run Lovable's Deep scan and read every finding.",[214,975,976],{},"Check your newest migrations for grants before October 30.",[25,978,235],{"id":234},[14,980,238,981,243,983,46,985,46,987,46,989,50,991,264,993,269],{},[125,982,242],{"href":241},[125,984,251],{"href":250},[125,986,255],{"href":254},[125,988,259],{"href":258},[125,990,263],{"href":262},[125,992,640],{"href":639},[125,994,268],{"href":267},{"title":271,"searchDepth":272,"depth":272,"links":996},[997,998,999,1000,1001,1002,1003,1004,1005],{"id":752,"depth":272,"text":753},{"id":792,"depth":272,"text":793},{"id":809,"depth":272,"text":810},{"id":836,"depth":272,"text":837},{"id":865,"depth":272,"text":866},{"id":894,"depth":272,"text":895},{"id":924,"depth":272,"text":925},{"id":208,"depth":272,"text":209},{"id":234,"depth":272,"text":235},"2026-10-20T09:00:00.000Z","Your Lovable app works in the preview but real users are coming. The 7 problems to check first, from open tables to edge functions and the Supabase October 30 change, with how to test and fix each one.",[1009,1012,1015,1018,1021],{"question":1010,"answer":1011},"Is my Lovable app secure if the security scan passes?","Not necessarily. Lovable says its scans \"cannot guarantee complete security\", and the Quick scan that runs on publish does not review your app code. Run the Deep scan and test access yourself with two accounts and with no login.",{"question":1013,"answer":1014},"Why can other users see each other's data in my Lovable app?","Usually because a table has row-level security turned off, or a policy that lets everyone in, such as USING (true). The browser talks to the database with a public key, so the policies are the only thing deciding who sees which rows.",{"question":1016,"answer":1017},"Will the Supabase October 30, 2026 change break my Lovable app?","Existing tables keep working. Once the change applies to your project (new projects since May 30, 2026, all existing projects on October 30, 2026), new tables return \"permission denied\" until a migration grants them to the right roles. If your app uses a Supabase project you own, the change applies. Lovable's docs don't say how Lovable Cloud handles it, so test a new table after that date.",{"question":1019,"answer":1020},"Can I move my Lovable app off Lovable Cloud?","Yes, but it is manual. You export your data and files, connect your own Supabase project and rebuild the schema. Lovable says removing Cloud \"permanently deletes your Cloud instance and cannot be undone\", so export first.",{"question":1022,"answer":1023},"Do I keep my code if I hire someone to fix my Lovable app?","Yes. Lovable syncs your project to a GitHub repository you own, and a developer can work from that repository. Lovable only syncs one branch at a time, so agree on which branch Lovable edits before anyone else pushes to it.",{"readingTimeStats":1025},{"text":309,"minutes":1026,"time":1027,"words":1028},6.9,414000,1380,"\u002Fblog\u002Flovable-app-rescue-2026","lovable app rescue",[1032,683],"supabase-permission-denied-new-tables-october-30-2026",{"title":736,"description":1007},[1035,1038,1041,1044,1047,1050,1052,1054,1057,1060,1061],{"title":1036,"url":1037},"Lovable docs, Security","https:\u002F\u002Fdocs.lovable.dev\u002Ffeatures\u002Fsecurity",{"title":1039,"url":1040},"Lovable docs, Supabase integration","https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fsupabase",{"title":1042,"url":1043},"Lovable docs, Lovable Cloud","https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fcloud",{"title":1045,"url":1046},"Lovable docs, GitHub integration","https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fgithub",{"title":1048,"url":1049},"Lovable docs, Best practices","https:\u002F\u002Fdocs.lovable.dev\u002Ftips-tricks\u002Fbest-practice",{"title":1051,"url":766},"NVD, CVE-2025-48757",{"title":1053,"url":772},"Matt Palmer, Statement on CVE-2025-48757",{"title":1055,"url":1056},"Supabase changelog, tables not exposed to the Data API automatically","https:\u002F\u002Fsupabase.com\u002Fchangelog\u002F45329-breaking-change-tables-not-exposed-to-data-and-graphql-api-automatically",{"title":1058,"url":1059},"Supabase docs, Database advisors","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fdatabase-advisors",{"title":712,"url":713},{"title":1062,"url":1063},"Supabase docs, Edge Functions auth","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Fauth","blog\u002Flovable-app-rescue-2026","lovable app rescue, fix lovable app, lovable security, lovable supabase rls, lovable cloud, lovable production, ai app rescue, vibe coded app, supabase row level security",[1067,1068,1069,1070,1071],"A Lovable app talks to its Supabase database straight from the browser with a public key, so row-level security (RLS) is what stops one user from reading everyone's data.","Lovable's own docs say \"Missing RLS policies are the most common way app data gets exposed,\" and that its scans \"cannot guarantee complete security.\"","The Quick scan runs every time you publish, but the Deep scan, which reviews your app code, does not run automatically.","Reverting in Lovable restores your code, not your database data, so test risky changes before real users depend on them.","Supabase now requires an explicit grant for new tables (in all existing projects from October 30, 2026), and existing tables keep theirs, so old leaks stay open.","https:\u002F\u002Fapp369.com\u002Fblog\u002Flovable-app-rescue-2026\u002F","KukPHur2EvLUOk0CH1xMOdwDUsEkE3PykZcqf7to-IU",[1075,1077,1079,1082,1083,1087],{"keyword":5,"url":369,"title":5,"relevance":1076},62,{"keyword":374,"url":732,"title":374,"relevance":1078},24,{"keyword":1080,"url":1081,"title":1080,"relevance":1078},"Bolt App Rescue: 8 Problems to Fix Before Launch","https:\u002F\u002Fapp369.com\u002Fblog\u002Fbolt-app-rescue-2026\u002F",{"keyword":736,"url":1072,"title":736,"relevance":1078},{"keyword":1084,"url":1085,"title":1084,"relevance":1086},"Base44 App Rescue: 8 Problems to Fix Before Launch","https:\u002F\u002Fapp369.com\u002Fblog\u002Fbase44-app-rescue-2026\u002F",23,{"keyword":1088,"url":1089,"title":1088,"relevance":1086},"Replit App Rescue: 7 Problems to Fix Before Launch","https:\u002F\u002Fapp369.com\u002Fblog\u002Freplit-app-rescue-2026\u002F",1792492263513]