Vibe coding security checklist: 10 checks before you ship
This vibe coding security checklist has ten checks to run before you share your AI-built app with strangers. Each one comes with a way to test it in a few minutes and a guide if it fails. You don't need a security background, just a logged-out browser window, a second test account, and your repo and Supabase dashboard.
QUICK CHECKLIST
- Open a private window (logged out)
- Create a second test account
- Have your repo and Supabase dashboard open
- Paste the fix prompt at the end for anything that fails
The 10-point vibe coding security checklist
| # | Check | How to test it |
|---|---|---|
| 1 | No secrets in code or git history (guide) | Run gitleaks on the repo. Search the built JS for sk-. |
| 2 | Every API route and server action checks who's calling | Call it with curl and no cookie. Expect 401. |
| 3 | Users can only access their own data (including deletes) | With account B, change an id to account A's record. |
| 4 | Database queries are parameterized | Search for SQL built with template strings. |
| 5 | CORS limited to your domain | Search for origin: "*" or Access-Control-Allow-Origin: *. |
| 6 | Rate limits on login and AI endpoints | Send 10 wrong passwords in a row. Expect a 429. |
| 7 | Prices and roles checked on the server (not from user_metadata), payment webhooks verified | Send a fake webhook without a signature. Nothing should change. |
| 8 | Dependencies without known vulnerabilities, and no made-up packages | Run npm audit. Look up unfamiliar names on npm. |
| 9 | Errors don't leak stack traces | Break a request on purpose and read the response. |
| 10 | Database rules (Supabase RLS) switched on | Query a table with the anon key while logged out. |
Building with Lovable? See what to check on a Lovable app before you launch.
Test it the way an attacker would
Most holes in AI-built apps show up in the first two passes. A logged-out request that returns data, or an edit that works on someone else's record, is a finding even if the UI never offers that button.
Automated scanners help with parts of this list. Which kind finds what is in repo scan vs URL scan.
Fix prompt you can paste
Audit this repo against this checklist: secrets in code or history, auth checks in every API route and server action, ownership checks on reads, updates and deletes, parameterized queries, CORS limited to our domain, rate limits on login, reset and AI routes, roles and prices checked on the server, verified payment webhooks, vulnerable or unknown dependencies, stack traces in error responses, and RLS on every Supabase table. For each failed check give file and line and a minimal fix.
FAQ
What is vibe coding security?
Checking an app you built by prompting an AI tool for the security holes those tools tend to leave: missing auth checks, open database rules, leaked keys and trust in the browser.
Which check matters most?
Checks 2, 3 and 10 cover who can read and change data, so start there if you only have ten minutes.
How often should I run this checklist?
Before launch, and again after any change to auth, database rules, payments or dependencies.
Can an AI tool run this checklist for me?
It can do a first pass with the prompt above. It can't log in as a second user and try the requests, so do passes 1 and 2 yourself.
Want a second pair of eyes?
We review your whole repo and write a fix prompt for every finding. $19, report within an hour.
Check my repoLeakcade is an automated check. It can miss vulnerabilities and is not a substitute for a professional security audit or pentest. Provided as is. You stay responsible for your code. Where the law allows, our liability is limited to what you paid ($19). Terms