Vibe coding security checklist
Ten checks to run before you share your AI-built app with the world.
The checklist
- No secrets in code or git history
- Every API route checks who's calling
- Users can only access their own data
- Database queries are parameterized
- CORS limited to your domain
- Rate limits on login and AI endpoints
- Prices and roles checked on the server
- Dependencies without known vulnerabilities (
npm audit) - Errors don't leak stack traces
- Database rules (e.g. Supabase RLS) switched on
Building with Lovable? See what to check on a Lovable app before you launch.
Want a second pair of eyes?
We review your whole repo and write a fix prompt for every finding. $19, report within an hour.
Check my repoLeakcade is an automated check. It can miss vulnerabilities and is not a substitute for a professional security audit or pentest. Provided as is. You stay responsible for your code. Where the law allows, our liability is limited to what you paid ($19). Terms