Lovable
Where a Lovable app puts API keys in the browser, how to search the published bundle, and how to move the call into an Edge Function before you share the link.
Checklists
Pre-launch checklists for Lovable, Bolt, Cursor, and v0
NextPlay Solutions · October 18, 2026
You are about to send a link. If a provider key is in the JavaScript, anyone who opens the link can copy it, and the bill goes to the account that created the key. That can be yours or your client's. These pages are the checks to make before you publish, one per tool.
Bolt
Where a Bolt app puts API keys in the browser, how to search the published bundle, and how to move the call into a server function before you share the link.
Cursor
Where a Next.js app built in Cursor leaks a provider key, how to search the published bundle, and how to move the call into a route handler or server action.
v0
Where a v0 app puts a provider key in the browser, how to search the published bundle, and how to move the call into a route handler or server action.
What each page walks through
Where that stack puts a key in the browser, how to search the live files in DevTools, how to move the call server-side, what to check on Supabase, whether /.env and /.git/config are being served, and which provider limits actually stop traffic. Each page ends with a prompt you can paste into that tool's agent. The $55,000 bill post is the public story these checks are written against. No page claims a clean scan means the app is safe.
Scan your app free
Paste a URL you own. The free scan takes about a minute and masks anything that looks like a key.
Scan your app free