Is my vibe-coded app secure? A 10-minute self-check

Short answer: you can't know without checking — and "the AI said it's secure" doesn't count. The model that wrote the code is also the one grading it, and it can't see what actually got deployed. The good news: the most expensive mistakes are also the easiest to spot from the outside.

What attackers look at first

• Your JavaScript bundles. Automated bots download new sites' JS and grep for API keys. A leaked OpenAI or Stripe key can be abused within hours.
• Your database permissions. If your app uses Supabase or Firebase from the browser, the rules (RLS) decide whether strangers can read your users' data.
• Forgotten files. /.env, /.git/, backups and source maps.

A 10-minute self-check

1. Open your app → F12 → Sources → search all files for sk_, sk-, AKIA, service_role, secret.
2. Open /.env and /.git/config on your domain. They should not return real files.
3. Run your URL through a header checker and look for CSP, HSTS and X-Frame-Options.
4. Log in as two different test users and confirm neither can see the other's data.
5. Ask your AI builder: "List every place a secret key is used and confirm none run in the browser."

What an automated scan can and can't tell you

An outside-in scan like ours sees exactly what any visitor (or bot) sees, which makes it great at catching leaked keys, exposed files, missing headers and certificate problems. It can't see your server code, your business logic or whether a logged-in user can access someone else's data. It's an automated check, not a security audit — use it as a fast first line, and get a human review before you handle sensitive data at scale. The precise list of checks is on how the scan works.

Make it a habit

Most leaks are introduced later, by a prompt that seemed unrelated. Re-check after each deploy; weekly + after-deploy monitoring is on our roadmap.