// Learn

Security explainers for vibe coders

The ideas behind the most common gaps, explained once, properly, with what to tell your agent.

• Supabase RLS: what it is and how to turn it on properlyRow level security (RLS) is a Postgres feature that decides, row by row, who can read or change data in a table. In Supabase the anon key ships inside your front end, so RLS policies are the only thing stopping anyone who copies that key from reading or editing every row.
• Public env variables: what ends up in the browserAny environment variable with a public prefix (NEXT_PUBLIC_ in Next.js, VITE_ in Vite, PUBLIC_ in SvelteKit and Astro, REACT_APP_ in Create React App, EXPO_PUBLIC_ in Expo) is copied into the JavaScript your visitors download. Publishable keys are fine there. Secret keys must stay unprefixed, be read only in server code, and be rotated if they ever shipped.
• Firebase security rules: the part that actually protects your dataYour Firebase apiKey only identifies your project, and it ships to every visitor. Firestore, Realtime Database and Cloud Storage security rules decide who can read and write each document or file, so rules that allow everything (if true, or an expired test mode rule replaced with if true) leave your data open to anyone.