← All guides

Vibe coding security checklist before you launch

Updated 22 October 2026 · 6 min read

Short answer: Before launching an AI-built app, check these 12 things: no secret keys in the frontend, RLS on every table, server-side auth checks, HTTPS and security headers, separate test and live databases, backups, verified payment webhooks, rate limits on AI endpoints, a privacy policy, account deletion, no source maps, and a re-scan after every big change.

Veracode tested 100+ AI models and found that 45% of the code they generated contained a known security flaw. (Veracode) Here's what to check before real users arrive.

Security

1. No secret keys in the browser. OpenAI, Stripe secret, Supabase service_role, all of them.

   My public frontend code contains a secret API key. Move every call that uses it into a server-side function (a Supabase Edge Function or an API route) that reads the key from an environment variable. Make sure the key no longer appears in any file that ships to the browser, then tell me which key to rotate.

2. RLS on every Supabase table (or locked Firebase rules). See the RLS guide.
3. Auth checked on the server.

   For every admin page, dashboard and API route in my app, make sure the server (or database policy) checks the user is logged in and has the right role. Hiding buttons in the browser doesn't count. List each route and how it's protected.

4. HTTPS everywhere + security headers.

   Redirect all http traffic to https, enable HSTS, and add X-Frame-Options, X-Content-Type-Options, Referrer-Policy and a Content-Security-Policy to every response.

5. Stripe webhooks verified.

   Make sure my Stripe webhook verifies the Stripe signature, and that orders are only marked paid from the webhook, never from the browser.

6. Rate limits on AI and paid endpoints so nobody can burn your credits.

Architecture

7. Separate test and live databases. In July 2025, an AI agent deleted SaaStr's production database during a code freeze because development and production shared one database. (TechTarget)

   Set up separate development and production databases for my app. The AI agent and preview environment must only use development. Explain how to deploy changes to production safely.

8. Backups you've tested restoring.
9. No source maps in production.

Privacy

10. A privacy policy that says what you collect and why (GDPR and India's DPDP Act).
11. Account and data deletion users can request.

    Add a 'Delete my account' option that removes the user's personal data from every table and storage bucket, and confirm by email.

12. Re-scan after every big change. Run a free Vibe Check.