The expertise you need. The attitude you want.
The expertise you need. The attitude you want.
Pre-launch security checklist for vibe-coded apps
AI coding tools will happily build you a working app in an afternoon. They're less reliable about noticing that any signed-in user can read every other user's records by changing an ID in the URL, or that a server key ended up in the browser bundle. Those mistakes don't show up when you click around your own app. They show up when someone else does.
This is the checklist to run before you launch. It follows the pre-launch workflow built into Vibewright's Vibe-Coding Tech Lead · Security Reviewer builds, which are live now. Run it only on apps you own or are authorized to test.
1. Access control on every route
Broken access control is number one on the OWASP Top 10:2025, the standard awareness list of web app security risks. In practice it means:
- Every API route checks who the user is and whether they're allowed to touch that specific record. Hiding an admin button in the UI is not protection.
- User-controlled IDs (in URLs, form fields, request bodies) are checked against the signed-in user before anything is read, edited or deleted.
- Test it with two accounts. Sign in as user A, copy a record ID, sign in as user B and try to read, edit and delete it through the UI and directly against the API. If you have teams or workspaces, repeat with two tenants.
2. Supabase and Firebase: the client key is public by design
If your app uses Supabase, read its API keys guide before launch. The short version from those docs:
- The publishable key (
sb_publishable_…, or the legacy anon key) is meant to ship in your web or mobile app. Anyone can read it, so it only reaches what Row Level Security allows.
- The secret key (
sb_secret_…, or the legacy service_role key) bypasses Row Level Security entirely. It belongs only on servers, Edge Functions and jobs you control, never in a browser, shipped app or repo.
- Supabase says to enable Row Level Security on every table before you deploy, and to review your policies for the
anon and authenticated roles. Its Security Advisor flags common problems.
- Supabase is deprecating the legacy
anon and service_role keys by the end of 2026, so if your AI tool told you to paste a long key starting with eyJ, plan the move to the new keys.
On Firebase, the same idea applies: data protection comes from Firebase Security Rules, and admin credentials stay server-side.
3. Secrets sweep
- No API keys, passwords or connection strings in client code, the repo, logs or prompts. Read them from environment variables.
- Watch framework prefixes like
NEXT_PUBLIC_: anything with a public prefix is shipped to the browser.
- Scan the code and git history with a scanner such as gitleaks or trufflehog. Deleting a key in a later commit doesn't remove it from history.
- Anything that was ever exposed gets rotated. Fix the leak first, then swap in the new key everywhere, then retire the old one.
4. Input, output and headers
- Parameterized queries or your ORM, never SQL built from user input. Validate request bodies with a schema.
- Avoid rendering raw user HTML (
dangerouslySetInnerHTML, v-html). Sanitize when you can't avoid it, and set a Content Security Policy.
- HTTPS everywhere, plus HSTS. No
* CORS on authenticated APIs.
- Error pages and API errors don't leak stack traces. The 2025 OWASP list added "Mishandling of Exceptional Conditions" as its own category.
5. Webhooks, uploads and rate limits
- Verify webhook signatures before trusting the payload (Stripe documents this in its webhooks guide), and handle repeat deliveries idempotently so a retried event doesn't double-fulfill an order.
- File uploads: restrict type and size, store them in a private bucket, and serve them through signed URLs.
- Rate-limit sign-in, password reset, AI endpoints and anything that costs you money per call.
6. Dependencies and the supply chain
"Software Supply Chain Failures" is new on the OWASP Top 10:2025. Run npm audit or pip-audit, fix Critical and High findings, and turn on Dependabot or Renovate. AI tools sometimes suggest packages that don't exist or are one letter off from a real one, so check every unfamiliar package name before you install it.
7. If your app calls an LLM
The OWASP Top 10 for LLM Applications covers the AI-specific risks. The ones that bite small apps first:
- Prompt injection, directly from users or hidden in documents and web pages your app feeds the model.
- Trusting model output: never pass it straight into SQL, a shell or raw HTML.
- Too much agency: tools that send, delete or spend should need a human approval step.
- Leaking data through prompts or logs, and unbounded cost from unmetered AI calls.
8. Backups and the day something goes wrong
- Backups are on, and you've actually tested a restore once.
- Write down your first-response steps now: rotate keys, revoke sessions, disable the affected feature, preserve logs, figure out what data was exposed, fix the root cause. If personal data was exposed, get legal and professional incident-response help, since there may be notification duties.
What the Security Reviewer build does with you
Paste a Security Reviewer build into your AI tool's standing instructions (Claude Projects, ChatGPT Projects, Gemini, Grok, Cursor and other agent frameworks) and say "run onboarding." It then walks you through:
- The pre-launch checklist above, with each item marked Pass, Fail or N/A.
- Security code reviews of your diffs, with findings rated Critical, High, Medium or Low and the file, line and fix for each.
- A secrets sweep, a dependency audit and a two-account access-control test plan.
- A "security check" on every answer: what could an attacker or a curious user do with this?
It won't attack systems you don't own, write malware, or run destructive commands like force-pushes or production migrations without your explicit approval. A review by the agent is not a certified security audit or penetration test, and it doesn't certify compliance such as SOC 2, HIPAA or PCI. Setup walkthroughs: Claude Projects and ChatGPT Projects (written for the CFO builds, same steps). Choosing a tool? See Claude Project vs ChatGPT Project vs Gemini Gem.
Then pick the voice you'll actually listen to when it tells you your auth is broken: Aggressive, Affirming, Dry, Funny, Sarcastic, Boardroom or Calm. Same findings, different delivery. See how agent tones compare.
Get the Security Reviewer builds
Every Vibe-Coding Tech Lead · Security Reviewer tone is live now and downloads right after purchase.
- Free sample: want to see how a Vibewright build is put together first? Claim the free CFO · Tax Planner · Funny build with your email. It is delivered on 10/26. License: Personal and commercial use allowed. No redistribution.
- Pick your tone: single build $9, role pack $49 (every Vibe-Coding Tech Lead build: App Architect, Bug Hunter, Security Reviewer and Ship-It Deployer), launch bundle $79, All-Access $19/mo or $149/yr, or Founding Member $199 lifetime for the first 100. 7-day refund on subscriptions. No refunds on downloads.
Choose your Security Reviewer tone on /pricing · Or grab the free sample