Pre-launch security checklist for vibe coders

Updated 16 October 2026 · ShipMender guides

You've built it, it works, and you're ready to post the link. Spend an hour on this list first. It's grouped so you can work through it in order and tick things off.

Secrets and keys

• No secret keys in front-end code or public environment variables.
• No .env files or secrets in your Git history.
• Separate keys for development and production.
• Any key that has ever been public is rotated.

More detail: leaked API keys in Lovable and Bolt apps.

Database and data access

• Supabase RLS enabled on every table, with policies that check ownership.
• Storage buckets private unless they genuinely need to be public.
• You've tested, as one user, that you can't read another user's data.

More detail: Supabase RLS mistakes in AI-built apps.

Authentication and access

• Every private page and API route checks the user on the server.
• Admin functions check a role on the server.
• Email confirmation and password reset flows work and expire.

Payments

• Stripe webhooks verify the signature.
• Prices and amounts come from the server, never from the browser.
• Access is granted only after a verified payment event.
• You've tested in Stripe test mode, including a failed payment.

Abuse and cost control

• Rate limits on login, signup, password reset and AI endpoints.
• Spending limits set on OpenAI and other usage-billed APIs.
• CAPTCHA or similar on public forms if you see bot traffic.

Configuration

• Debug mode off; no stack traces shown to users.
• CORS limited to your own domains.
• HTTPS everywhere, with basic security headers (HSTS, X-Content-Type-Options, a frame policy).
• Dependencies updated and checked with npm audit or similar.

Recovery and legal basics

• Database backups switched on, and you know how to restore one.
• Basic error logging so you notice when things break.
• A privacy policy that says what you collect and why. If you have UK or EU users, UK GDPR or EU GDPR applies.

Want the reasoning behind each item? Start with is my vibe-coded app secure? A 12-point checklist.