PreflightHow it worksPricingSampleGuides

Vibe coding security checklist

Twenty checks for an app built with AI tools, in the order that matters: your users’ data first, then keys, sign-up, hosting and launch. Each one says how to test it.

Run the free scanSee a sample report →

Free scan: GET and HEAD requests only, after you verify you own the domain. The two-account cross-user test is the $29 Proof Report. Updated 25 Oct 2026

In short

  • ✓The biggest risks in AI-built apps are data leaks: tables anyone can read, and users who can reach each other’s rows.
  • ✓Next come secret keys shipped in the browser bundle, usually through a public env prefix.
  • ✓Hosting issues (exposed files, headers, CORS) are smaller but cheap to fix.
  • ✓Each check below says how to test it yourself and whether Preflight tests it.

AI coding tools are good at making features work and less reliable at the rules that stop the wrong person using them. The checks are ordered by damage: a leaked table hurts more than a missing header. If your app uses Supabase, also work through the Supabase security checklist.

01Your data and who can read it

  1. 1Strangers can’t read your tables

    AI tools often create tables without row level security. With your public key, anyone can then read every row.

    How to check Signed out, request each table with the public key and Prefer: count=exact (how).

    Preflight Free scan counts signed-out rows on up to 35 tables.

  2. 2Users can’t read each other’s data

    A policy that says “signed-in users can read” lets any new account read everything.

    How to check Sign in as two accounts and request the other’s rows by id.

    Preflight Proof Report, with two test accounts you create.

  3. 3Users can’t write as someone else

    Insert policies need a with check that ties the row to the signed-in user.

    How to check As user A, insert a row with user B’s user_id.

    Preflight Proof Report tries a forged-owner insert.

  4. 4Users can’t upgrade themselves

    If a user can update their own profile, can they also set plan, credits or is_admin?

    How to check Update those fields on your own row through the API.

    Preflight Proof Report sets them, re-reads, and sets them back.

  5. 5Uploaded files stay private

    Public buckets serve every file to anyone with its URL.

    How to check Upload as user B, try to list and download as user A (how).

    Preflight Free scan: bucket listing. Proof Report: cross-user file access.

02Keys and secrets

  1. 6No secret keys in the browser bundle

    Keys for OpenAI, Stripe, Resend or your database admin key get copied and abused within hours of being found.

    How to check Search your live site’s JavaScript for sk-, sk_live_, sb_secret_, re_.

    Preflight Free scan: more than 15 kinds of secret key.

  2. 7No secrets behind public env prefixes

    VITE_, NEXT_PUBLIC_ and EXPO_PUBLIC_ values are inlined into the bundle.

    How to check Read your env file and rename any secret with those prefixes.

    Preflight Free scan finds the result in the bundle.

  3. 8AI calls go through your server

    Calling a model API from the browser means shipping the key. Use a server route or Edge Function, with a per-user limit.

    How to check Check the network tab for requests to model APIs.

    Preflight Free scan finds AI keys in the bundle.

  4. 9Leaked keys were rotated

    Deleting a key from code doesn’t revoke it. Rotate anything that ever shipped (how).

    How to check List keys that were ever in git history or a build.

    Preflight Not checked: git history isn’t visible from outside.

03Sign-up and sign-in

  1. 10Email confirmation is on

    Without it anyone can create unlimited accounts with fake addresses, and every “signed-in only” rule gets weaker.

    How to check Supabase: Authentication → Sign In / Providers → Confirm email.

    Preflight Free scan reads your auth settings.

  2. 11Anonymous sign-ins are off unless you use them

    Anonymous sessions count as authenticated.

    How to check Check the anonymous sign-ins setting.

    Preflight Free scan reads your auth settings.

  3. 12Cookies are flagged

    Session cookies should be HttpOnly, SameSite and sent over HTTPS only.

    How to check DevTools → Application → Cookies.

    Preflight Free scan checks cookie flags.

04Hosting and the browser

  1. 13No .env, .git or source maps online

    Deploys sometimes publish the project folder. Source maps hand out your original code.

    How to check Request /.env, /.git/config and your bundle’s .map. Expect 404s.

    Preflight Free scan checks these, plus .DS_Store and debug routes.

  2. 14HTTPS everywhere

    Plain HTTP should redirect, and the certificate should be valid.

    How to check Open http:// your domain and check where it lands.

    Preflight Free scan checks the redirect and TLS.

  3. 15Security headers are set

    Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and frame protection limit what an injected script or another site can do.

    How to check DevTools → Network → your page → Response headers.

    Preflight Free scan checks headers and frame options.

  4. 16CORS doesn’t trust every site

    Access-Control-Allow-Origin: * with credentials, or reflecting any origin, lets other sites call your API as your users.

    How to check Send a request with Origin: https://example.com and read the response.

    Preflight Free scan checks CORS.

  5. 17No libraries with known holes

    Old versions of popular libraries have published vulnerabilities.

    How to check Run your package manager’s vulnerability report locally.

    Preflight Free scan looks up detected libraries in the OSV database.

05Before and after launch

  1. 18Your email domain can’t be spoofed

    Without SPF and DMARC, anyone can send email that looks like it came from you.

    How to check Look up your domain’s TXT records.

    Preflight Free scan checks SPF and DMARC.

  2. 19Payments are confirmed on the server

    A success page is not a payment. Grant access from a verified webhook only.

    How to check Visit your success URL without paying.

    Preflight Not run: Preflight doesn’t call your webhooks.

  3. 20You re-check after every big change

    One prompt can turn off a policy. Re-run your checks after each release.

    How to check Keep this list and rerun it.

    Preflight Monitor re-runs the outside checks weekly.

06If you only have an hour

  1. Checks 1 and 6: what strangers can read, and keys in your bundle. These are where most real leaks come from.
  2. Check 2: two accounts, one tries to read the other.
  3. Check 10: email confirmation.
  4. Check 13: try /.env and /.git/config on your domain.

Then ask your AI tool to fix what you found, one finding at a time, and test again. For tool-specific notes see Lovable and Bolt.new.

07What Preflight covers

Every item above is marked. The free scan covers 1, 5 (bucket listing), 6–8 and 10–18 from outside, using GET and HEAD requests on a domain you’ve verified. The $29 Proof Report adds 2–5 on Supabase apps, as two test accounts you create. Check 9 and 19 need access Preflight doesn’t have. See what a finished report looks like in the sample.

?Questions people ask

  • What is the biggest security risk in vibe coding?

    Data exposure: database tables anyone can read with the public key, and policies that let any signed-in user reach every row. UpGuard reported 16,326 Supabase databases with at least one anonymously readable table in September 2026.

  • Are apps built with Lovable or Bolt.new less safe?

    Not inherently. They use the same building blocks as hand-written apps. The risk is that nobody reviewed the access rules the AI wrote, so check them before real users arrive.

  • Can I ask the AI to fix security issues?

    Yes, one finding at a time, with specific instructions, and then test again. Watch for fixes that make a table or bucket public, or that use the service role key to get past an error.

  • How often should I run this checklist?

    Before launch, after any change to tables, policies, auth or env variables, and on a schedule after that. One prompt can undo an earlier fix.

  • Do I need a professional security review?

    For a small app, this checklist and an automated scan catch the common problems. If you handle payments directly, health or financial data, or sell to larger companies, a professional review is worth it.

What an outside scan can't tell you

Can one user read another user's data?

Preflight signs in as two test accounts you create and tries to read one account's rows and files from the other. That cross-user test is the $29 Proof Report for Supabase apps. Start with the free scan: it checks your live app from outside with GET and HEAD requests only.

Run the free scanPricing →