Vibe coding security checklist: 12 checks before you launch

By Shinobi Tech, the team behind AppLeakWatch. Updated .

Before launch, confirm no secret reaches the browser, every table has access rules, private pages check who's asking, and no risky files are online. Then keep checking, because each new AI edit can change what's exposed.

Why this happens

A demo only has to work for you. A live app has to keep working when a stranger tries things you never planned for.

How to check

  1. No secret keys in browser code.
  2. Row-level security or Firebase rules on all data.
  3. Every API route checks who's calling it.
  4. Storage buckets are private unless meant to be public.
  5. No .env, .git or database backups online.
  6. Source maps aren't published.
  7. Debug pages are off.
  8. HTTPS works and plain HTTP redirects to it.
  9. Security headers are set.
  10. Cookies use Secure, HttpOnly and SameSite.
  11. SPF and DMARC records are set for your domain.
  12. Spending limits are set on paid APIs.

How to fix it

  1. Work through failures from most to least serious.
  2. Test as a signed-out visitor and as a second user.
  3. Scan again after every big AI change.

Prompt for your AI tool

Review this app against a production security checklist: secrets, database access rules, API login checks, storage, exposed files, source maps, debug pages, HTTPS, headers, cookies and rate limits. Give me a table of pass or fail for each, then fix the failures.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

Can my AI tool check its own work?

It helps, but it can miss things and it only sees your code. Test the live app from the outside too.

Does passing this mean I'm secure?

No checklist can prove that. It removes the common mistakes strangers look for first.

Related guides