An AI assistant with live access can go wrong in three places: it reads a secret it should not, it acts without approval, or it fails where nobody is looking. Here is the design answer to each, plus seven questions to put to your developer before you switch anything on.
Sandeep Mundra
A vibe-coded SaaS is not production-ready because the demo works. It is ready when twenty gates — auth, RLS, API caps, CI, and GDPR — can fail the release.
Sandeep Mundra
If a React bundle can call OpenAI, Stripe, or Supabase with a privileged key, the internet already has that key. Move the call to the server.
Sandeep Mundra
Client-side redirects from Bolt and v0 are not auth. Put the session in an httpOnly cookie and check it in Next.js middleware and every data route.
Sandeep Mundra
Most MVPs built on Lovable, Replit, or Cursor ship with an exposed database key or inverted access policy. Here's what IndiaNIC's security team finds in audits, and the 72-hour framework we use to fix it before launch.
IndiaNIC
An AI assistant with live access can go wrong in three places: it reads a secret it should not, it acts without approval, or it fails where nobody is looking. Here is the design answer to each, plus seven questions to put to your developer before you switch anything on.
Sandeep Mundra · 14 Sep 2026 · 9 min read
A vibe-coded SaaS is not production-ready because the demo works. It is ready when twenty gates — auth, RLS, API caps, CI, and GDPR — can fail the release.
Sandeep Mundra · 22 Aug 2026 · 6 min read
If a React bundle can call OpenAI, Stripe, or Supabase with a privileged key, the internet already has that key. Move the call to the server.
Sandeep Mundra · 20 Aug 2026 · 6 min read
Client-side redirects from Bolt and v0 are not auth. Put the session in an httpOnly cookie and check it in Next.js middleware and every data route.
Sandeep Mundra · 17 Aug 2026 · 7 min read
Most MVPs built on Lovable, Replit, or Cursor ship with an exposed database key or inverted access policy. Here's what IndiaNIC's security team finds in audits, and the 72-hour framework we use to fix it before launch.
IndiaNIC · 1 Aug 2026 · 7 min read
An AI assistant with live access can go wrong in three places: it reads a secret it should not, it acts without approval, or it fails where nobody is looking. Here is the design answer to each, plus seven questions to put to your developer before you switch anything on.
Sandeep Mundra · 14 Sep 2026
Sandeep Mundra · 22 Aug 2026
Sandeep Mundra · 20 Aug 2026
Sandeep Mundra · 17 Aug 2026
IndiaNIC · 1 Aug 2026
Popular topics
ESC to close · ⌘K to open
Pick what we may store. You can change this any time.
Cookie settings
Granular control, stored on this device and honoured on every page.