GUIDE · SECURITY
Vibe-coded app security checklist
The biggest security risks in AI-built apps are database rules that let anyone read data with the public key, secret keys shipped to the browser, authorization enforced only in the UI, and unverified payment webhooks. Check these nine things before real users arrive.
Why AI-built apps leak data
Tools like Lovable and Bolt often have the browser talk directly to Supabase using a public anon key. That is safe only when Row Level Security policies restrict every table. In 2025 this class of misconfiguration in Lovable-generated apps was published as CVE-2025-48757. The same risk applies to any app where the client queries the database directly.
The checklist
- Turn on RLS for every exposed table. In Supabase, every table in an exposed schema needs Row Level Security enabled. Tables with RLS off are readable with the public anon key.
- Replace blanket policies. Policies like using (true) for anon or authenticated users let anyone read or write. Tie rows to auth.uid().
- Keep secret keys on the server. Service role keys, Stripe secret keys and AI provider keys must never reach the browser bundle.
- Rotate any key that was ever exposed. Deleting a key from code does not remove it from Git history or old builds.
- Enforce authorization on the server. Hiding a button is not access control. Check roles in API routes, Edge Functions and database policies.
- Verify Stripe webhooks. Verify the signature on the raw body and decide payment status on the server, never from the browser.
- Lock down auth settings. Set the production Site URL and Redirect URLs, require email confirmation where appropriate, and use a real email sender.
- Protect Edge Functions and APIs. Require a valid user token where needed and restrict CORS to your domain.
- Test as an attacker. Call your API with only the anon key and as a second user, and confirm you cannot see other users' rows.
How to test your own app
Follow how to check if your Supabase data is exposed for exact queries. Only test apps you own.
Get a $149 diagnosis See pricing Book the $469 audit Fix my auth & database security
- Fixed, or we keep working free until it is (within the written scope).
- A human reviews every fix before it ships.
- read-only access; fixes arrive as pull requests you merge
- Your $149 diagnosis is credited in full toward any paid job.
FAQ
Is a vibe-coded app safe to launch?
It can be, once database rules, secret keys, server-side authorization and payment webhooks are checked. Speed of building is not the risk; skipped checks are.
Is the Supabase anon key a secret?
No. The anon (publishable) key is meant to be public. Security comes from Row Level Security. The service role (secret) key must never be in the browser.
Does Lovable's security scan replace an audit?
No. Automated scans help, but they cannot confirm that each policy matches who should see which rows in your app.
What does a security audit cost?
VibePitstop's standalone audit is $469 fixed. The Launch Path ($1,195 flat) includes one.