Fix Me AIFree one-pager
Vibe Coding Security Checklist
16 checks before you launch an app built with Lovable, Bolt, v0, Replit or Cursor. Print it, share it, tick it off.
Short version: no secret keys in the browser, RLS on every table, server-side auth checks, separate test and live data, and a way for users to delete their data.
Security
- ☐ No secret keys (OpenAI sk-, Stripe sk_live_, Supabase service_role / sb_secret_) in frontend code or VITE_ / NEXT_PUBLIC_ variables
- ☐ Row Level Security on every Supabase table (or locked Firebase rules)
- ☐ Admin pages and API/edge functions check login and role on the server
- ☐ HTTPS redirect, HSTS and basic security headers
- ☐ Payment webhooks verify signatures; orders marked paid only server-side
- ☐ Rate limits on AI and paid endpoints
Architecture
- ☐ Separate test and live databases
- ☐ Backups you've restored at least once
- ☐ No source maps or .env files publicly reachable
- ☐ Project in your AI builder set to private
Privacy
- ☐ Privacy policy + plain consent notice (GDPR / DPDP)
- ☐ Users can download and delete their data
- ☐ Breach notification email drafted
- ☐ Re-scan after every big change
Every item has a copy-paste fix prompt in the full checklist guide. Fine to share or reprint with a link to fixmeai.app/checklist.