# Protecting Lovable & Supabase Edge Function AI Apps

> One-prompt setup guide for Lovable.dev, Bolt.new, and Supabase Edge Functions (Deno) using fail-open pre-screening.

## Why Public AI Apps Need Input Screening

Apps built with Lovable, Bolt, and Supabase Edge Functions are easy to launch, which also makes their public chat endpoints a frequent target for automated scripts, people trying to copy your hidden system instructions, and visitors using your chat box to write unrelated code or essays on your AI bill.

### One-Prompt Lovable Setup

Save `M6L_GATE_KEY` in your Supabase Secrets, then paste this instruction into your Lovable chat box:

```
In our Supabase Edge Function that calls the AI model, add a fail-open pre-check to https://getgated.ai/v1/check using Deno.env.get("M6L_GATE_KEY") with a 400ms AbortSignal.timeout BEFORE calling the LLM. If allow === false, return HTTP 200 with the gate's polite message so we do not spend AI tokens on blocked prompts.
```

### Complete Deno / Supabase Edge Function Code

```
const gateKey = Deno.env.get("M6L_GATE_KEY");
if (gateKey) {
try {
const res = await fetch("https://getgated.ai/v1/check", {
method: "POST",
headers: {
"Authorization": `Bearer ${gateKey}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
user: userId || "anon",
input: lastUserMessage,
messages: messages.length,
feature: "chat",
}),
signal: AbortSignal.timeout(400),
});
if (res.ok) {
const verdict = await res.json();
if (!verdict.allow) {
return new Response(
JSON.stringify({ reply: verdict.message, blocked_by_gate: true }),
{ status: 200, headers: { ...corsHeaders, "Content-Type": "application/json" } }
);
}
}
} catch {
// Fail open silently if edge check times out
}
}
```