Three fixes that are worth shipping before anything else. Each one takes minutes, you can verify it with a single command, and you do not need a Zoltra account to use it. We write these so you can close the seam today — and so you know what Zoltra would keep watching for tomorrow.
No paywall. Each post has the fix, the verification, and the common ways the mistake drifts back.
How NEXT_PUBLIC_ silently bakes keys into JavaScript sent to every visitor, why it matters more now that agents scrape everything, and the two-line rename that closes it.
Fix: rename to server-only · Verify: curl the bundle
2 · 8 min · Supabase / PostgresWhy a fresh table without Row Level Security is reachable by any granted role, how leaked anon keys make that worse, and the one policy pattern that fixes the common case.
Fix: enable RLS + revoke anon · Verify: one SELECT as anon
3 · 7 min · Route HandlersHow a quick endpoint that returns rows becomes a public data API, why auth on the frontend page does not cover the handler, and the one check that actually closes it.
Fix: check the caller · Verify: curl without a session
Zoltra watches what your site exposes, tells you what matters most, and checks your fix actually worked. The posts above are the fixes you can ship without us — and the things Zoltra would not let drift back.