Blog
Security & GDPR for AI-built apps
Practical guides from the team behind the scanner — what actually goes wrong in vibe-coded apps and how to fix it.
98% ship without a Content-Security-Policy, 95% load trackers before consent, 45% hotlink Google Fonts. The data from 55 passively scanned Lovable apps, and how to fix each finding.
2026-08-11Cookieless analytics — the platforms that need no cookie banner →Cookieless analytics measures traffic without a consent banner. Which platforms qualify under § 25 TDDDG, what each one gives up, and the exact setup we run on this site.
2026-08-11Firebase security rules — the two-minute test that shows whether your Firestore is public →Bolt and v0 apps often ship with Firestore in test mode. How to check from the outside whether your database answers to strangers, and how to lock it down.
2026-08-11Impressumspflicht bei Nebenprojekten — wann Ihre Side-Project-Website eines braucht →Ab wann gilt § 5 DDG für Side Projects und Indie-Apps? Die geschäftsmäßig-Grenze in Klartext, was ins Impressum gehört und was bei Verstößen droht.
2026-08-11Ist meine Lovable-App DSGVO-konform? Die 15-Punkte-Checkliste →Was wir bei jeder Lovable-App prüfen, bevor sie deutsche Nutzer bekommt — offene Datenbanken, Tracking vor Einwilligung, Google Fonts, Impressum.
2026-08-11Source maps in production — what they leak and how to turn them off in Vite and Next.js →A public .map file hands out your readable source code — comments, logic, sometimes secrets. How to check your app and disable them in Vite, Next.js, and CRA.
2026-08-06Is your Bolt.new app GDPR compliant? What to check before taking EU users →Bolt apps ship fast — often with Supabase defaults, template trackers and no legal pages. What to check before your app meets EU users.
2026-08-06Do you need a cookie banner for your Lovable app? →Maybe not. When EU law actually requires consent, when it doesn't, and how to add a banner to a Lovable app without breaking the rules.
2026-08-06Google-Fonts-Abmahnung vermeiden — die 15-Minuten-Lösung →Google Fonts direkt von Google zu laden überträgt Besucher-IPs in die USA. Warum das abgemahnt wird und wie Sie Fonts in Ihrer App selbst hosten.
2026-08-06Do side projects need an Impressum? German imprint rules for indie hackers →When a side project needs a German imprint under § 5 DDG, what has to be in it, and what to do about publishing your home address.
2026-08-06Is your Lovable app GDPR compliant? The 15-point checklist →The 15 things we check on every Lovable app before it takes EU users — what each one means, why it matters, and how to fix it.
2026-08-06Row Level Security in Lovable apps — why your database might be public →Lovable apps ship with Supabase. Without Row Level Security, your users table can be readable by anyone. How to check and how to lock it down.
2026-08-06Writing a privacy policy for an AI-built app — what Art. 13 GDPR requires →Art. 13 GDPR says what a privacy policy must contain and when. How to inventory your real stack and avoid the generic-generator trap.
2026-08-06CSP, HSTS, nosniff, X-Frame-Options — what security headers actually do →Security headers are instructions to the browser. What each one protects against, which to set first, and how to add them on Vercel, Netlify and Next.js.
2026-08-06Self-hosting Google Fonts — the 15-minute fix for a classic GDPR finding →Loading fonts from fonts.googleapis.com sends visitor IPs to Google. Why a German court cared, and how to self-host fonts in any AI-built app.
2026-08-06anon key vs service_role key — the Supabase mistake that hands strangers your database →Supabase's two keys look alike and do opposite jobs. How the service_role key ends up in frontend bundles, how to check yours, and what to do if it did.
2026-08-06Is your v0 app GDPR compliant? What Vercel's defaults do and don't cover →v0 apps ship on a stack with decent defaults — fonts, HTTPS. But backend rules, consent, and legal pages are still on you. Here is the pre-launch pass.
2026-08-06Shipping a vibe-coded app safely — the security basics AI builders skip →Vibe-coded apps fail in predictable places: data access rules, secrets, consent, legal pages, headers. A repeatable launch pass that catches all five.