Home › Guides

The vibe coding security checklist: 20 checks before you ship

Updated 2026-10-21 · 9 min read

“Vibe coding” (describing what you want and letting an AI write it) is a legitimately fast way to ship. AI assistants optimize for working code, though. Unless you ask, they rarely add rate limits, lock down databases or keep keys out of the browser. Work through these 20 checks before you post your launch on X.

Check yours in 30 seconds: paste your live URL into the free ShipGrader scan. It reads only what your site already serves to every visitor and gives you an A–F launch grade with the top fixes.

Secrets

  1. No secret keys in frontend code. Anything prefixed VITE_, NEXT_PUBLIC_ or REACT_APP_ is public. Only publishable keys belong there.
  2. No secrets in git history. If a key was ever committed, rotate it. Removing it from the latest commit isn’t enough.
  3. .env is in .gitignore and not deployed. Check yoursite.com/.env returns 404.
  4. Production source maps are off (Vite build.sourcemap: false, Next.js default) or uploaded privately to your error tracker.

Auth & data

  1. Database access rules are on. Supabase: RLS on every table (checklist). Firebase: no allow read, write: if true, and test-mode rules replaced.
  2. Authorization is checked on the server, not just by hiding buttons. Ask your AI: “Where is it enforced that user A can’t read user B’s data?”
  3. Users can’t edit their own role, plan or credit balance.
  4. Email verification and password reset work, and reset links expire.
  5. File uploads are restricted by type and size and stored in private buckets.

Money & abuse

  1. Hard spend limits on OpenAI / Anthropic / Google Cloud / AWS, with budget alerts.
  2. Rate limits on every expensive endpoint (AI calls, email sending, sign-ups).
  3. Stripe webhooks verify signatures, and access is granted from the webhook, not from the success-page redirect.
  4. Prices are set on the server, never taken from the browser request.

Browser hardening

  1. HTTPS everywhere, with http redirecting to https and an HSTS header.
  2. Content-Security-Policy (start with report-only).
  3. X-Frame-Options: DENY (or CSP frame-ancestors) and X-Content-Type-Options: nosniff.
  4. No user input rendered as raw HTML (dangerouslySetInnerHTML, v-html) without sanitizing.

Launch paperwork

  1. Privacy Policy listing every service that touches user data (see privacy policy for AI apps).
  2. Terms of Service and Refund policy that match your pricing page word for word on trials, refunds and cancellation.
  3. Cookie consent if you load Google Analytics, Meta Pixel, Hotjar or similar for EU/UK visitors, or switch to cookieless analytics.

A prompt to give your AI assistant

Act as a security reviewer. List every place this app reads or writes user data and show me where authorization is enforced on the server for each. List every environment variable and tell me which are exposed to the browser. Flag any secret key that is bundled into frontend code, any database table without row-level security, and any endpoint without rate limiting. Don't change code yet; give me a prioritized list.

Then run ShipGrader on the live URL to confirm the deployed site matches what the AI says.

Want the full fix list?

The $29 Full Report lists every finding with step-by-step fixes, plus Privacy Policy, Terms and Refund starter text written for the services we detect in your app.

Scan my app free →