Vibe coding security: ten things to check before real users arrive

The checklist

1. No secret keys in the browser

   Keys for AI services, payments or email must live on the server. Open your app, look at its page source and network requests in the browser's developer tools, and search for "key", "secret" or "sk-". Anything secret you find there can be copied by anyone.

2. Database access rules are switched on

   If your app uses Supabase or a similar service, check that row-level security is enabled on every table, and that each rule really limits people to their own rows. A table with no rules is open to anyone who has the public key.

3. Users cannot see each other's data

   Create two test accounts. Logged in as one, try to open the other's records by changing an ID in the address bar or in a request. If it works for you, it works for anyone.

4. Permissions are checked on the server

   Hiding an admin button is not protection. Every action that changes data must be checked on the server, not only in the interface.

5. Login is handled by a proven service

   Use the platform's own authentication or a well-known provider, never a home-made table of passwords. Test password reset and email confirmation from start to finish.

6. Payments are confirmed by the payment provider

   An order counts as paid only when the payment provider confirms it to your server, never because the page in the browser says so.

7. Forms and AI features have limits

   Sign-up, contact forms and anything that calls an AI service need rate limits, so a bot cannot flood you or run up your bills overnight. Set spending limits with the AI provider too.

8. No secrets in your code history

   A key committed to GitHub stays in the history even after you delete it. If one was ever committed, replace it with a new one at the provider.

9. Backups exist, and you have tried a restore

   Know where your backups are and how to restore one — and try it once, before the day you need it.

10. You know what runs where, in whose name

    Hosting, database, domain, payment and AI accounts registered to you or your company, with access you control and can take away from anyone else.

If you find a problem

Fix the most dangerous first. Replace any exposed key at its provider straight away, then switch on access rules for open data, then work through the rest. If real people's data may have been exposed, check whether you need to inform them.

Why AI tools miss this

AI builders answer the request in front of them: make this screen, add this button. Security lives in the parts nobody asks for — rules, checks and limits that are invisible in a demo. An AI will often fix a specific issue well when you describe it precisely. It will rarely notice one you did not mention.

When it is worth getting help

• The app stores customer accounts, payments or personal data.
• You found problems on this list and are not sure you fixed them properly.
• You cannot tell what runs where, or in whose name.

• Your AI-built app works in the demo, but not with real users
• Moving an app off Lovable
• Vibe coding: what it is and how to start