Scan free
Guides

A security checklist for vibe-coded apps

AI tools are good at making features work and less reliable at making them safe. Work through this list before real users arrive.

Secrets

  • No secret keys in the repo or its git history (scan with gitleaks).
  • No secret keys behind NEXT_PUBLIC_ or VITE_ prefixes.
  • Any key that was ever exposed has been rotated.

Database access (Supabase and similar)

  • Row Level Security is enabled on every table in the public schema: alter table name enable row level security;
  • No insert, update or delete policies with using (true) or with check (true) unless you truly want anyone to write.
  • Policies tie rows to the user, e.g. using (auth.uid() = user_id).
  • The service_role key is only used on the server.

API routes and server actions

  • Every route that reads or changes private data checks the current user first and returns 401 if there isn't one.
  • Routes check the user owns the record they're touching, not just that they're logged in.
  • Prices, roles and user IDs come from the server, not the request body.
  • Payment webhooks verify their signature.

Dependencies

  • npm audit (or pip-audit for Python) shows no critical or high issues you haven't reviewed.
  • Your framework is on its latest patch release.

Breakage risk

  • The production build succeeds without disabling type checks or lint.
  • TypeScript errors are fixed, not hidden with ignoreBuildErrors.

Launch basics

  • Error messages don't expose stack traces or secrets to users.
  • File uploads limit type and size.
  • You have a privacy policy and terms if you collect personal data or take payments.

Check your app now, free

Paste a GitHub repo or your live app's URL. You get a free score in under a minute, with no signup. The $19 Full Report gives a copy-paste AI fix for each issue found, and you get a full refund if the scan fails.

Only scan repos and sites you own or are authorized to test. See our Terms.

No signup · read-only · we never keep your code. How we handle your code

No signup. We only read. We never run your code or attack your site. We never keep your code, only your report. Reports are saved so you can track progress over time. Delete anytime on request. See the leaderboard

Full Report: $19See a sample report

General guidance. A fast automated check for the most common security mistakes in AI-built apps. Not a substitute for a full security audit. Updated 2026-10-19.

All guides · Home · Terms · Privacy