Add to Discord

Home › Guides

Vibe Coding Security Checklist: 12 Checks Before You Ship an AI-Built App

AI tools make it easy to ship an app in a weekend. They also make it easy to ship your API keys to the whole internet. Run through these 12 checks before you share the link.

Secrets

  1. No keys in the frontend. Anything in client code (React, Next.js client components, Vite VITE_ vars) is public. Move paid API calls behind a server route.
  2. No keys in git history. Search the repo for sk-, api_key, secret and .env. If a key was ever committed, rotate it; deleting the file is not enough.
  3. .env is in .gitignore. Check before your first push, not after.

Auth and data access

  1. Every server route checks the user. Not just "is someone logged in" but "does this user own this record."
  2. Database rules are not wide open. Supabase row-level security on, Firebase rules not set to allow read, write: if true.
  3. Admin pages are protected on the server. Hiding a button in the UI is not access control.
  4. IDs in URLs are not trusted. Changing /invoice/41 to /invoice/42 should not show someone else's invoice.

Input and output

  1. Validate input on the server. Client-side validation is a UX feature, not a security one.
  2. No raw SQL built from strings. Use parameterized queries or your ORM.
  3. No unsanitized HTML. Search for dangerouslySetInnerHTML and innerHTML.

Shipping

  1. Rate-limit anything that costs money. An AI endpoint with no limit is an open tab on your card.
  2. Audit dependencies. Run npm audit (or your package manager's equivalent) and check that every package the AI added actually exists and is the one you meant.

A prompt for an AI security pass

Paste this into Cursor, Claude or ChatGPT with your server files attached:

Review these files for security issues only. Do not edit code.
Check: exposed secrets, missing auth or ownership checks, open database rules,
unvalidated input, SQL or HTML injection, and unmetered paid API calls.
Output: a list ranked by severity, each with file, line, why it matters,
and a one-line fix. If you are unsure, say so instead of guessing.

Get a quick roast first

Run /roast with a public GitHub URL in the free Prompt Medic Discord. It reads your README, file tree and key files and returns a score out of 10, the top security issues, bugs and quick wins. AI reviews can miss things or be wrong, so treat it as a first pass, not a pentest. 1 free roast a day.

Add to Discord

FAQ

Is AI-generated code secure?

Not by default. AI coding tools optimize for "it works," so they often skip authorization checks, hardcode secrets, or leave database rules open. Review those areas yourself or ask the AI for a dedicated security pass before you ship.

How do I check my vibe-coded app for security issues?

Search the repo for API keys, confirm every server route checks who the user is and whether they own the data, lock down database rules, validate input on the server, and run a dependency audit. A quick AI review such as Prompt Medic /roast can flag the obvious problems, but verify each finding.

Can I ask Cursor or Claude to do a security review?

Yes. Ask for a review only, not edits: "List security issues in these files, ranked by severity, with the line and a one-line fix. Do not change any code." Then fix them one at a time.

More guides