🌐 App: https://example-shop.lovable.app (made up)

• critical Live Stripe secret key in your JavaScript bundle

  Found sk_live_****************************7Qx in /assets/index-3f9a2c.js (line 1, column 48211). Anyone who opens your site can copy it and create charges, refunds or payouts on your Stripe account.

  Fix: Roll the key in Stripe → Developers → API keys now. Move every Stripe call to a server function (Supabase Edge Function, Vercel route) and keep only the publishable pk_ key in the browser.

• high Supabase table 'profiles' readable without signing in

  The public anon key can read rows from profiles (we asked for 1 row and didn't store it). Row Level Security is off or has a policy that allows everyone.

  Fix: ALTER TABLE profiles ENABLE ROW LEVEL SECURITY; then add a policy so users only read their own row (auth.uid() = id).

• low Missing Content-Security-Policy header

  Without a CSP, a single injected script can run with full access to your page.

  Fix: Add a Content-Security-Policy header in your host config, starting with default-src 'self'.

What you'd paste into Lovable, Bolt, Cursor or v0:

My app has a live Stripe secret key (sk_live_…) bundled into the frontend JavaScript.
1. Remove every use of the Stripe secret key from client-side code.
2. Create a server-side function that creates Checkout sessions, reading STRIPE_SECRET_KEY from environment variables.
3. In the browser, only use the publishable key (pk_…).
Also enable Row Level Security on the "profiles" table and add a policy so each user can only select their own row (auth.uid() = id).