A 10-Minute Security Checklist Before You Ship Your Vibe-Coded App
You don't need a security background to avoid the worst mistakes — you need ten focused minutes and a checklist. Run these before you post your launch tweet. Most items are a quick look; a couple are a quick fix. All of them are cheaper now than after someone finds the hole.
Secrets (3 minutes)
Search your front-end code and bundle for any `sk_`, `service_role`, AWS, or private keys — none should be there. Confirm secret keys live only in your host's environment settings. Visit `/.env` on your live URL and confirm a 404. Background: Stop Leaking API Keys.
Database access (3 minutes)
For Supabase: confirm RLS is enabled on every table with user data and test that a second account can't see the first account's rows. For Firebase: confirm you're out of test mode and that Storage rules are set, not just Firestore. See Is My Supabase Database Exposed?.
Headers and transport (2 minutes)
Confirm the site is HTTPS-only and add HSTS. Set `X-Content-Type-Options: nosniff` and frame protection. Plan a CSP even if you ship it in report-only mode first. Details in Security Headers, Explained.
Cookies and exposed files (2 minutes)
Session cookies should be `HttpOnly`, `Secure`, and `SameSite`. Check that `/.git/config` and any `backup.sql` return 404. Then run a passive scan of your live URL to catch anything you missed — Secure The Vibe does all of the above automatically.