Keep secrets out of the browser
Anything your site sends to the visitor's browser can be read by anyone. API keys for paid services (payment providers, email, AI models) must stay on a server or in a backend function — never in the front-end code or in settings that end up there.
Lock down the database
Many of these tools use Supabase. Its public key is meant to be visible — the protection comes from Row Level Security (RLS) rules on every table. Without them, anyone can read or change your data. Check every table has RLS turned on, with rules that only let people see their own records.
Use your own domain, properly
- Connect a custom domain you own, with HTTPS, so your address doesn't change if you move platforms.
- Set up email authentication (SPF, DKIM and DMARC) if the site sends email from your domain, so it doesn't land in spam.
Own your code
Connect the project to GitHub (most AI builders can) so you always have a copy you control and can host elsewhere if you need to.
Make it findable
Many AI-built sites draw everything with JavaScript, which search engines and link previews don't always read well. Check each page has its own title and description, and test how your link looks when shared. If it's important that Google finds you, it may need pre-rendering — something I can sort out.
Forms and abuse
Public forms and sign-ups attract bots. Add spam protection (such as Cloudflare Turnstile) and limits on how often a form can be sent, so nobody can flood your inbox or run up your bills.
