Short answer: before you share an app built with Lovable, Bolt, Replit, v0 or Cursor, check five places: the JavaScript your homepage ships (secret keys, test keys, localhost URLs, source maps), your response headers, your sign-in provider's redirect settings, your domain's DNS, and the template defaults left in index.html . Each check below takes under a minute with DevTools, curl or dig , and most fixes are a few lines.

Grab the scripts your homepage loads once; several checks reuse them:

APP = https://yourapp.com for s in $( curl -s $APP | grep -oE 'src="/[^"]+\.js"' | cut -d '"' -f2 ) ; do curl -s " $APP$s " ; done > bundle.js

Enter fullscreen mode

Exit fullscreen mode

Or search them in DevTools → Sources (Cmd+Option+F / Ctrl+Shift+F).

Security

1. Secret keys in your frontend bundle

What goes wrong: "add Stripe checkout" can put a secret key in browser code, readable by anyone.

Check: grep -oE '(sk|rk)_live_.{4}|sk-proj-.{4}' bundle.js .…