Guide · 2 min read · Updated
Vibe coding security checklist: 10 checks before launch
AI tools build fast, and they leave the same few mistakes behind again and again. Here are the ten worth checking before real people use your app, in order of how much they can hurt.
The five that can cost you money or data
- No secret keys in your code. Keys for OpenAI, Stripe and other paid services belong in environment variables on your server, never in code the browser downloads. How to fix it.
- Your .env file isn't saved in git. If it is, every key in it is in your project's history. Replace the keys and stop tracking the file. How to fix it.
- Every database table is locked. In Supabase, turn on row level security for every table and add rules for who can read and change each row. Supabase RLS, explained simply.
- Payments are verified. Your app should only unlock paid features after checking that the payment message really came from Stripe. How to fix it.
- AI features have a spending limit. Put a rate limit in front of any feature that calls a paid AI service, and set a monthly cap with your AI provider. How to fix it.
The five that make abuse easy or hide problems
- Admin access is checked on the server, not decided by a value in the visitor's browser. Why.
- User text is shown as text, not raw HTML, so nobody can hide a script in a comment. Why.
- Only your site can call your server. Replace a CORS setting of "*" with your real web address. Why.
- You'll hear about errors before your users do. Add error tracking and a friendly error screen. Why.
- Signup, login and payments are tested. One automatic test for each catches the breakages that hurt most. Why.
Check all ten in one go
SIGSHIP checks for these and more on your own computer, for free. Open a terminal in your project folder and run:
npx sigshipThen run npx sigship --prompt and paste the result into your AI tool. It fixes everything in order. Run the check again until it says GO. A GO means these checks found nothing that blocks launch. It does not prove the app is safe.
Questions
Is vibe coding safe for production apps?
It can be, if you check the result. AI tools write working code quickly, but they often skip security steps like locking database tables or verifying payments. A checklist and an automatic check catch most of them.
What is the most common security mistake in AI-built apps?
Secret keys and open databases. AI tools often put API keys where the browser can see them, and create Supabase tables without row level security.