A security checklist for vibe-coded apps

AI tools are good at making features work and less reliable at making them safe. Work through this list before real users arrive.

Secrets

• No secret keys in the repo or its git history (scan with gitleaks).
• No secret keys behind NEXT_PUBLIC_ or VITE_ prefixes.
• Any key that was ever exposed has been rotated.

Database access (Supabase and similar)

• Row Level Security is enabled on every table in the public schema: alter table name enable row level security;
• No insert, update or delete policies with using (true) or with check (true) unless you truly want anyone to write.
• Policies tie rows to the user, e.g. using (auth.uid() = user_id).
• The service_role key is only used on the server.

API routes and server actions

• Every route that reads or changes private data checks the current user first and returns 401 if there isn't one.
• Routes check the user owns the record they're touching, not just that they're logged in.
• Prices, roles and user IDs come from the server, not the request body.
• Payment webhooks verify their signature.

Dependencies

• npm audit (or pip-audit for Python) shows no critical or high issues you haven't reviewed.
• Your framework is on its latest patch release.

Breakage risk

• The production build succeeds without disabling type checks or lint.
• TypeScript errors are fixed, not hidden with ignoreBuildErrors.

Launch basics

• Error messages don't expose stack traces or secrets to users.
• File uploads limit type and size.
• You have a privacy policy and terms if you collect personal data or take payments.

Automated checks and general guidance, not a substitute for a professional security audit.

All guides · Home · Terms · Privacy