Your AI built something that works. Before you share the link, spend an hour on this vibe coding security checklist. Each item has one plain sentence on why it matters and one test you can do yourself, no coding required.
1. No secrets in your code
Why: API keys in code end up on GitHub, in your browser bundle, or in screenshots. Test: Ask your AI: "Search the whole project for anything that looks like an API key, password or token, and list the files." Anything found should move to environment variables.
2. Secrets set on your host, not just your laptop
Why: Your .env file usually isn't uploaded, so the live site needs its own copies.
Test: Open your hosting dashboard's environment variables page and check every key your app needs is there.
3. Only public keys in public variables
Why: Variables starting with NEXT_PUBLIC_ or VITE_ are sent to every visitor's browser.
Test: Read every variable with those prefixes. None should be a secret key.
4. Login actually protects pages
Why: Hiding a button isn't the same as protecting the data behind it. Test: Sign out, then paste the address of a private page directly into the browser. You should be sent to login.
5. Database rules are on
Why: On Supabase and similar tools, the browser talks to the database directly. Test: Follow our Supabase RLS guide and do the two-account test.
6. Spend caps on every paid API
Why: A leaked AI or email API key can run up a large bill overnight. Test: Log in to each provider (OpenAI, Anthropic, email services) and set a monthly budget or usage limit.
7. Rate limits on forms and AI features
Why: Anyone can submit your form ten thousand times with a script. Test: Ask your AI: "Which endpoints can be called without limits? How would you add rate limiting?"
8. Uploads are restricted
Why: Unrestricted uploads can host malware or fill your storage. Test: Try uploading a huge file and a file with the wrong type. Both should be refused.
9. Payments are confirmed on the server
Why: If your app trusts the browser to say "payment succeeded", anyone can fake it. Test: Ask your AI how paid access is granted. The answer should involve a webhook from your payment provider, checked on the server.
10. Errors don't leak details
Why: Error pages that show code, file paths or database messages help attackers. Test: Visit a page that doesn't exist and submit a form with junk. You should see a friendly message, not a wall of technical text.
11. You can undo
Why: Something will break eventually. Recovery is a security feature. Test: Check your project is in git and pushed somewhere private. See how to undo AI changes.
12. Privacy basics
Why: If you collect emails or personal data, people expect to know what you do with it. Test: Your site has a short privacy page, and you know where user data is stored and how to delete it on request.
Make your AI run the audit
Act as a security reviewer for a beginner's app. Go through these 12
areas: secrets in code, host env vars, public variable prefixes, auth on
pages, database access rules, API spend caps, rate limits, uploads,
payment verification, error messages, backups and git, privacy. For each,
tell me pass, fail or unsure, with one sentence of evidence. Change nothing.
Treat the AI's answer as a starting point, not a guarantee. If anything comes back "unsure", check it yourself.
Get the full version
A one-page version of this checklist is in our free starter pack. The Ship-Safe Starter Kit has the full 12-section pre-deploy checklist with more detail on each step, plus rules that stop many of these problems before they start.
Written with AI assistance and reviewed by a human. This is general guidance, not a professional security audit.
Want these rules ready-made?
The free starter pack has them, set up for Cursor and Claude Code.