Vibe Coding Security Checklist: Secure Your AI-Built App
Built something with AI? Whether you used Bolt.new, Lovable, v0.dev, Replit, or Cursor, this checklist will help you ship securely. Print it out, check each item, and launch with confidence.
What is "Vibe Coding"?
Vibe coding is building apps by describing what you want to AI tools like Bolt.new, Lovable, v0, or Cursor. The AI generates the code, you tweak it until it "vibes" right. It's fast and powerful—but the AI doesn't prioritize security.
1. Secrets & API Keys
AI Often Gets This Wrong
When you tell AI to "add OpenAI integration," it often puts the API key in client-side code. Always move it to an API route.
2. Database Security
3. Authentication
4. Security Headers
// next.config.js - add these headers
headers: async () => [{
source: '/:path*',
headers: [
{ key: 'X-Frame-Options', value: 'DENY' },
{ key: 'X-Content-Type-Options', value: 'nosniff' },
{ key: 'Strict-Transport-Security', value: 'max-age=31536000' },
]
}]
5. Input & Data Handling
6. Deployment
Quick Reference by Platform
Supabase Apps
- • Enable RLS on all tables
- • Write policies with auth.uid()
- • Anon key OK in frontend
- • Service key = server only
Firebase Apps
- • Write security rules
- • Use request.auth
- • API key OK in frontend
- • Service account = server only
Vercel/Next.js
- • Secrets in Vercel dashboard
- • Use API routes for secrets
- • Add security headers
- • Disable source maps
Replit
- • Use Secrets tool
- • Make Repl private if needed
- • Check version history
- • Use Deployments for prod
Automate Your Security Checks
VAS automatically checks most items on this list. Get a comprehensive security report with copy-paste fixes in minutes.