The Vibe-Coding Security Checklist: 12 Things to Fix Before Launch

AI coding tools, Claude Code, Cursor, Lovable, Bolt, Replit, v0, are astonishingly good at turning an idea into a working app. What they don't do is guarantee that app is safe for real users. This checklist is the gap between a working prototype and a product you can launch without leaking your users' data.

Work through it in order, the first few are the ones that actually get apps breached. Each item says what to check and why it matters.

The critical five: do these before anyone signs up

1. No open database tables

The single most common breach in AI-built apps: a Supabase (or Firebase) table anyone can read without logging in. Turn on Row-Level Security for every table and add a policy per table. Full walkthrough: check your Supabase RLS.

2. No secrets in your frontend

View your live app's source and search its JavaScript for anything like sk_live_, service_role, AWS keys, or PRIVATE KEY. Secret keys belong only in server-side code, never in what the browser downloads. Anything visible can be copied and used.

3. Every private API route checks for a login, on the server

Hiding a page in the interface is not protection. The endpoint underneath must reject requests that aren't authenticated. Test it: call your data endpoints without a session and confirm they return "unauthorized," not data.

4. Admin routes are locked down

Open your admin and dashboard pages in an incognito window (logged out). They should redirect to login. If admin data loads, the guard is cosmetic, move it to the server.

5. Authentication actually works

Confirm the obvious things really hold: you can't reach another user's data by changing an id in the URL, password reset can't be abused, and sessions expire. AI tools sometimes wire auth logic backwards, blocking logged-in users and letting anonymous ones through, so test both paths.

The next seven: before you scale

6. Rate limiting

Without limits, endpoints can be brute-forced, scraped, or abused to run up bills, especially any route that calls a paid AI or email service. Add sensible per-user and per-IP limits.

7. Security headers

Set Content-Security-Policy, Strict-Transport-Security, and X-Content-Type-Options. They're a free layer against content injection and protocol downgrade.

8. HTTPS everywhere

The whole app must be served over HTTPS, with HTTP redirecting to it. On modern hosts (Vercel, Netlify) this is usually automatic, confirm it's actually enforced.

9. CORS locked to your own domain

An API that answers Access-Control-Allow-Origin: * combined with cookie-based login can let a malicious site act on your users' behalf. Restrict it to your own origin.

10. Backups you've actually tested

Confirm your database is backed up and that you know how to restore it. An untested backup is a hope, not a safety net.

11. Error tracking

Add something (Sentry, your host's logs) that tells you when the app breaks in production, otherwise your users are your monitoring, and they leave instead of reporting.

12. Cost controls

Set spending caps and alerts on any paid service the app calls. "It cost $20 to build" can quietly become "$2,000 this month" when an unprotected endpoint gets discovered.

How to run the whole list at once

You can work through the list above yourself, and this guide is meant to let you do exactly that. If you would rather have someone look at it, send me your app's address and I will go through it myself before we speak, then tell you what I found in half an hour. It is free, there is no pitch at the end, and if your app is in good shape I will tell you that.

Building specifically with Lovable? Start with is my Lovable app secure?