example-app.lovable.app

In this project, remove the exposed secret key from all frontend/client code. Move the API call that uses it into a server-side function (e.g. a Supabase Edge Function, Next.js API route or server action) that reads the key from a server-only environment variable, and have the frontend call that function instead. Never prefix this variable with NEXT_PUBLIC_ or VITE_. Explain what you changed, and don't change unrelated code. IMPORTANT: also revoke/rotate the key in the provider's dashboard now, because it has already been exposed.

In this project, audit Supabase Row Level Security. List every table in the public schema, confirm RLS is enabled on each, and write policies so users can only read and write their own rows (e.g. using auth.uid() = user_id). Flag any table that is readable by anon without a reason, and any storage bucket that is public. Explain what you changed, and don't change unrelated code.

In this project, add a Content-Security-Policy response header for all pages. Start with a policy that allows only our own origin plus the third-party domains the app actually uses (list them by checking network requests), e.g. default-src 'self'; script-src 'self' <needed domains>; object-src 'none'; base-uri 'self'; frame-ancestors 'self'. Test in Content-Security-Policy-Report-Only mode first so nothing breaks. Explain what you changed, and don't change unrelated code.

In this project, add the response header Strict-Transport-Security: max-age=31536000; includeSubDomains on all HTTPS responses (only once every subdomain supports HTTPS). Explain what you changed, and don't change unrelated code.

In this project, disable public source maps in the production build (e.g. Vite: build.sourcemap = false; Next.js: productionBrowserSourceMaps = false), or upload them privately to the error-tracking tool instead of serving them. Explain what you changed, and don't change unrelated code.

In this project, add a <meta name="description"> of 120–160 characters to every page that summarises the page for search results. Explain what you changed, and don't change unrelated code.