Home / Threats

Security threats to vibe-coded apps

Short briefs on the threats we check for: what each one is, who's affected, a safe way to check your own site, and the fix. Sources are linked on every page.

Exposed .env file

Your secrets file can be downloaded from your live site.

Supabase tables readable without RLS

The anon key is public by design; Row Level Security is what keeps strangers out of your rows.

Gemini API keys (AQ. auth keys) in client code

New Gemini keys start with AQ. and must never ship in your JavaScript.

Vite dev server on a live site

Running vite or npm run dev in production serves your source and, on older Vite versions, files like .env.

Check your site for all of them

Run the free scan → Free single-question checkers