Home / Ebook
App Security for Vibe Coders
The pre-launch playbook for Lovable, Bolt, Cursor & Replit apps. Plain-English explanations, 2-minute self-checks and copy-paste prompts you can hand back to the AI that wrote your code.
$9 · PDF · instant download
29 pages, 12 chapters. Download link emailed right after checkout.
Digital product delivered instantly, so all sales are final. See the Terms.
What's inside
- Why vibe-coded apps leak (and the METR stolen-key story)
- Leaked API keys: OpenAI, Stripe, OpenRouter, Groq, xAI, Google/Gemini and public env prefixes
- Supabase: RLS, Storage buckets and the new sb_publishable_/sb_secret_ keys (plus Firebase rules)
- Exposed .env, .git, project files and source maps
- Auth and admin routes
- Security headers and CORS
- Payments and webhooks
- Guard Kit: catch keys before you commit
- The pre-launch checklist
- Copy-paste prompts for Lovable, Bolt, Cursor and Replit
- Scan, fix, prove: a walkthrough on a deliberately leaky demo app
- Keep going: habits that keep it fixed
Who it's for
Builders who shipped (or are about to ship) an app with an AI builder and want to know what actually matters before real users and real money show up. No security background needed.
How it relates to the free guides and the Fix Pack
- Free guides cover one topic each. The ebook puts the whole pre-launch process in one place, in order, with a checklist.
- The free scan tells you what's wrong with your app. The ebook explains why, including what a passive scan can't see (auth, admin routes, webhooks).
- The $29 Fix Pack gives prompts written for your app's actual findings, a read-only deep check and re-scans that prove the fix.
Not a penetration test, audit or legal advice. Questions before buying? hello@shiplatch.com