Vibe coding security: the checklist before you put your app online
Vibe coding lets you launch an app in days. But the AI writes what you ask for, and nobody asks it “can anyone read my database?”. Here are the ten checks that prevent the vast majority of leaks.
The 10-point checklist
- 01No secret key in the code, or in Git history.
- 02No secret key in a public variable (NEXT_PUBLIC_, VITE_).
- 03Row Level Security on for every Supabase table, with no “true” policy.
- 04Every API route and server action checks who is calling.
- 05No SQL query or command built by concatenation.
- 06Dependencies with no known flaw (CVE), lockfile present.
- 07Passwords hashed with a modern algorithm (bcrypt, argon2).
- 08Session cookies set HttpOnly, Secure and SameSite.
- 09HTTPS forced and security headers in place (HSTS, CSP).
- 10No source maps or debug mode in production.
Ten free analyses every month, no card needed. First report in minutes.
Analyse my app for free