Security checklist before you launch a vibe-coded app

A 15-minute pre-launch security pass for apps built with Lovable, Bolt, Replit, Cursor or v0: secrets, database rules, files, auth, headers and payments.

Before you post your app anywhere, spend 15 minutes on the mistakes that actually get AI-built apps in trouble. None of this needs a security background.

1. Secrets

• Search the live site's JS for sk-, sk_live_, service_role, sb_secret_, AKIA and ghp_. Anything secret in the browser must be rotated and moved server-side.
• Publishable keys (Supabase anon, Stripe pk_, Firebase web config) are fine in the browser. Their safety depends on the rules below.

2. Files

• https://YOUR_DOMAIN/.env and /.git/HEAD should return 404. Source maps (.map files) are worth turning off in production too.

3. Database rules

• Supabase: RLS on for every table in public, with policies scoped to auth.uid(). See Enable Supabase RLS.
• Firebase: no allow read, write: if true. See Firebase rules open to the public.
• Storage buckets with user files are private. See Supabase Storage bucket security.

4. Auth and admin

• Hiding an admin button is not protection. Every admin action must be checked on the server or by a database policy.
• Try your app signed out and as a second test user. Can user B see user A's data by changing an id in the URL?

5. Payments

• Unlock paid features from a verified Stripe webhook, never from a "success" page the browser can open on its own.

6. Headers

• Add HSTS, X-Content-Type-Options: nosniff, a frame-ancestors / X-Frame-Options rule and a basic CSP. See Security headers for vibe-coded apps.

Do a pre-launch security review of this app. 1) List any secret keys reachable from frontend code and move them server-side. 2) Make sure .env, .git and source maps are not served in production. 3) Confirm RLS is enabled on every Supabase table (or Firebase rules are not open) with per-user policies. 4) Make sure admin features are enforced on the server, not just hidden in the UI. 5) Make sure paid features unlock only from a verified Stripe webhook. 6) Add HSTS, nosniff, X-Frame-Options and a basic CSP. Report what you changed.

More guides

• Is my Lovable app secure?
• How to enable Supabase Row Level Security (RLS)
• Exposed Supabase service_role key: what to do now
• Lovable security checklist