Vibe coding security checklist
Is vibe coding safe? It can be. AI tools build fast and skip the boring safety work. This checklist covers the most common gaps in apps built with AI, in plain words, so you can check your own app before your customers do.
Your first report and call are free.
Secrets and keys
- No secret keys (payment, email, database admin) in code that runs in the browser.
- Keys you ever shared in a chat, a screenshot or a public repository have been replaced.
- Each key only has the access it needs.
Who can see what
- Every database table has rules that limit users to their own data.
- Changing an id in the address bar never shows someone else's data.
- Admin actions are blocked on the server, not just hidden in the menu.
Logins and accounts
- Password reset links expire and work only once.
- Sign-up cannot be used to create an admin account.
- Logged-out visitors cannot open pages meant for customers.
Payments
- Prices and payment status are decided on the server.
- Payment webhooks are verified, so nobody can fake a "paid" message.
- A failed or repeated payment cannot create a duplicate order.
Data and privacy
- You know what personal data you store, where, and why.
- You can delete a customer's data when they ask.
- Backups exist, and you have tried restoring one.
Before every release
- Automatic checks run on every change, before it reaches customers.
- You can undo a bad release quickly.
- Someone who understands the code looks at changes to payments, logins and data.
What one gap can cost
A shop app sends the price from the customer's browser to the payment page. It works perfectly in every test. Then someone changes 49 to 1 before it is sent, pays 1, and the order shows as paid.
Nothing looked wrong, because the app only ever trusted what it was told. The fix is for the server to look up the price itself. That is what "decided on the server" means in the list above, and why the payments section is there.
Is vibe coding bad?
No. It lets founders build things that would have taken a team months. The trouble starts when the app has real users and nobody checks what the AI built. That is fixable, and it is what we do.
Questions
How long does this checklist take?
If you can read your own code and database settings, an afternoon. If you cannot, that is a good reason to get a free Snapshot instead.
Does this replace a security audit?
No. It catches the most common gaps. An Expert also finds the ones specific to your business, like a payment flow that lets people skip paying.
My AI tool says the app is secure. Is that enough?
Not on its own. AI checking AI tends to agree with itself. A person looks at the whole app, and at what a problem would cost you.
Related
Your first report and call are free.