Vibe Coding Security Checklist: 12 Things to Check in an App Built With Lovable, Cursor, Bolt or Replit Before Launch (2026)

What Should a Vibe Coding Security Checklist Cover?

A vibe coding security checklist covers twelve checks in four groups: data rules and access, secrets and keys, payments and abuse, and deployment and upkeep. Each check below takes about five minutes with a browser and the hosting dashboard. Aibrify runs the whole list as a $300 security check over two days and quotes each fix found at $100 or $300.

A vibe coding security checklist lists the settings and code paths an app built with Lovable, Cursor, Bolt or Replit must get right before launch. The list covers who can read the data, where keys live, how payments are verified and what happens when data is lost.

The list exists because published scans keep finding the same gaps. Matt Palmer's March 2025 scan of 1,645 Lovable projects found 170 with readable tables, about 10.3 percent. Escape scanned 5,600 published apps in October 2025 and found more than 2,000 vulnerabilities, 400 or more exposed secrets and 175 instances of personal data.

Aibrify is a software studio in Los Angeles that fixes and maintains apps built with these tools. The $300 security check covers the whole app in two days: exposed keys, missing sign-in checks or database rules and unprotected paid endpoints. Every finding comes back with a fixed quote, $100 for a simple fix and $300 for one that crosses systems.

The twelve checks below each state what to look for, how to test in five minutes and what a fix costs. The cost guide for fixes covers the diagnosis and rebuild prices.

Why Do Apps Built With Lovable, Cursor, Bolt and Replit Need a Security Check Before Launch?

Generated apps need a security check because the tools produce working features and leave the protections to the owner. Wiz Research described four recurring gaps in September 2025. They were sign-in handled in the browser, keys in client-side code, database tables open to everyone and internal tools published without a login.

Tenzai tested 15 apps built with five coding tools in December 2025 and found 69 vulnerabilities. None of the 15 had protection against cross-site request forgery, and none set security headers such as HSTS or a content security policy.

Keys leak at the source too. GitGuardian counted 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34 percent on the year before. Commits made with one coding assistant leaked a secret 3.2 percent of the time, against a 1.5 percent baseline.

Lovable's own security documentation calls misconfigured RLS rules a common cause of data leaks and says its scan cannot guarantee complete security. The standard behind the list is the OWASP Top 10 for 2025, which ranks broken access control first. That edition draws on data from more than 2.8 million applications.

IBM's 2026 report puts the global average cost of a data breach at $4.99 million, a record and 12 percent above the year before. The twelve tests themselves cost nothing but an hour.

The chart shows four findings from four scans with different samples; the table gives the samples and sources.

What Are the 12 Security Checks for a Vibe-Coded App?

The twelve checks run in the order an attacker would try them: data, keys, money, then recovery.

Data rules and access (checks 1 to 4)

1. Row level security is on for every exposed table.

• Look for: the RLS marker on every table in the database dashboard. Supabase's row level security guide says that with RLS on, no data is reachable through a publishable key until a policy exists.
• Five-minute test: log out, open the browser's network tab, copy a request to a table endpoint, remove the authorization header and resend it. Rows coming back is a fail; this is the method in Matt Palmer's statement that found 170 exposed projects.
• Fix: $100 for one table set, $300 when the data permissions need rebuilding.

2. The password check happens on a server, not in the browser.

• Look for: any page that compares a password in front-end code. Wiz Research found apps that did the whole sign-in on the client without contacting a backend.
• Five-minute test: open a protected page's address in a private window while logged out, then search the page source for the word "password". Either the page opening or a stored password is a fail.
• Fix: $300, because sign-in crosses the front end, the server and the database.

3. One customer cannot open another customer's record.

• Look for: record addresses or requests that carry an ID, such as an order or invoice number. Broken access control is A01 in the OWASP Top 10 for 2025.
• Five-minute test: sign in as one test customer, open a record, then change the ID in the address or the request to another number. A second customer's data appearing is a fail.
• Fix: $100 when one page checks the wrong thing, $300 when the rule has to be rebuilt across tables.

4. Admin and internal pages require a login.

• Look for: dashboards, staging copies and internal tools that were published along with the app. Wiz reported many such tools reachable on the public internet without authentication.
• Five-minute test: in a private window, open /admin, /dashboard and any internal address the builder mentioned. Any page that renders data is a fail.
• Fix: $100 to put the page behind the existing sign-in.

Secrets and keys (checks 5 and 6)

5. No secret key sits in the front end or the repository.

• Look for: provider keys pasted into components, or a database secret key used from the browser. Supabase's key guide is blunt: a secret key bypasses every RLS policy, so it must never reach a browser, a shipped app or source control.
• Five-minute test: open the published JavaScript and search for "service_role", "sk_live", "sk-" and the prefixes of every provider in use. Then search the repository history for .env; any hit is a fail, and the key is rotated the same day.
• Fix: $100 to move the call behind a server function and rotate the key.

6. Every third-party key has a spending cap and usage alerts.

• Look for: model, map, email and text-message providers billed by usage. Palmer's scan found exposed keys that could cause unintended spend, and OWASP's API security list counts a missing spending limit as a vulnerability.
• Five-minute test: open each provider's billing page and confirm a monthly cap and an alert address. No cap is a fail, even when the key is well hidden.
• Fix: the owner sets the cap; moving the call server-side with a limit is a $100 fix.

Payments and abuse (checks 7 to 9)

7. Payment webhooks are verified.

• Look for: the route that receives payment events and whether it checks the signature. Stripe's webhook guide warns that without verification an attacker can send fake events that fulfil orders or grant account access.
• Five-minute test: send an empty POST to the webhook address from a terminal. A 200 response is a fail; a 400 with a signature error is a pass.
• Fix: $300, since payments count as a complex fix.

8. Prices and amounts are set on the server.

• Look for: an amount that travels from the browser to the payment provider. Stripe's quickstart creates the checkout session on the server because the secret key cannot be exposed in client-side code.
• Five-minute test: in the network tab, edit the amount in the checkout request to 1 and resend it. A cheaper charge going through is a fail.
• Fix: $300, bundled with check 7 when both fail.

9. Sign-in and public forms have rate limits.

• Look for: the limits on sign-in attempts, password resets and public forms. Supabase's auth rate limits default to 30 sign-in requests per five minutes and 2 emails an hour with the built-in provider.
• Five-minute test: submit the sign-up or contact form 40 times with a script or by hand. Every submission landing in the database is a fail.
• Fix: $100 to add limits and a challenge on public forms.

Deployment and upkeep (checks 10 to 12)

10. HTTPS is enforced and security headers are set.

• Look for: a Strict-Transport-Security header, which tells browsers to use HTTPS only, and a content security policy. Tenzai found that none of the 15 test apps set CSP, X-Frame-Options, HSTS or X-Content-Type-Options.
• Five-minute test: run the address through a free header scanner, or read the response headers in the network tab. Missing HSTS is a fail.
• Fix: $100 to add the headers at the hosting layer.

11. Dependencies carry no known vulnerabilities.

• Look for: the package list and its last update date. Lovable's own scan audits dependencies for known vulnerabilities, and npm audit does the same from the repository.
• Five-minute test: run npm audit in the repository, or the tool's built-in security scan. Any high or critical finding is a fail.
• Fix: $100 once; the $49 Care plan keeps dependencies and security updates current.

12. Backups exist and production data is separate from test data.

• Look for: a backup schedule and a database that the builder cannot reach from a development session. Supabase's backup guide gives Pro projects seven days of daily backups and tells free-tier projects to export their own data.
• Five-minute test: find the date of the last backup, then restore it into a copy. No backup, or a restore that fails, is a fail.
• Fix: $100 to enable backups and split the environments.

How Long Does the Checklist Take and What Do the Fixes Cost?

The twelve tests take about an hour in total, and seven of the twelve fixes are $100 simple fixes at Aibrify. Two of the remaining five cost $100 or $300, depending on how much of a rule needs rebuilding. The other three cost $300 for touching sign-in or payments.

The table image lists all twelve checks; the rows below repeat them as text.

The donut shows how the twelve checks split across the four groups. The table gives the counts.

A third of the list is access control, which matches its first place in the OWASP ranking.

After the check, the $49 Care plan keeps checks 11 and 12 true every month. It bundles hosting, monitoring and backups with dependency and security updates, one change of up to an hour and a two-business-day response. Care Plus at $149 adds four hours of changes, next-business-day response and third-party interface changes handled.

When Is a Security Check the Wrong Purchase?

Three kinds of app do not need a paid check. They are a brochure site with no login and no data, a prototype holding test data, and an app the diagnosis says to rebuild.

A brochure site with no login and no data. Checks 10 and 11 still apply, and both are free to run; nothing else on the list has anything to protect. The Lite website at $390 setup and $5 a month is the product for that site; see the website page.

A prototype holding test data. Run the free tests, but spend the money on the brief for the real build. The written scope for a new build can name these twelve checks as acceptance criteria.

An app the diagnosis says to rebuild. When sign-in, payments and data rules are all broken, a $300 check would price fixes nobody will buy. The cost guide for fixes sets out when a rebuild from $5,000 beats a list of fixes. The ownership guide covers who owns the result.

Frequently Asked Questions (FAQ)

What is a vibe coding security checklist?

A vibe coding security checklist is a twelve-point list of the settings and code paths to verify before a generated app takes real customers. The checks fall into four groups: data rules and access, secrets and keys, payments and abuse, and deployment and upkeep. Each takes about five minutes to test.

Are apps built with Lovable, Bolt, Cursor or Replit safe to launch?

Apps built with these tools are safe to launch once the twelve checks pass, and not before. Matt Palmer's 2025 scan found readable tables in 170 of 1,645 Lovable projects, and Tenzai found no CSRF protection in any of 15 test apps. The tools' own documentation leaves database rules and key storage to the owner.

How can I tell whether my app's database is exposed?

Log out, open the browser's network tab, copy a request to a table endpoint, remove the authorization header and resend it. Rows coming back mean the table has no row level security and anyone with the public key can read it. Aibrify fixes one table set for $100, or $300 when the data permissions need rebuilding.

Where should API keys go in a Lovable or Bolt app?

API keys belong in the platform's secrets store and are used only from a server function, never from front-end code or a repository file. Anything in the front end ships to every visitor. When a key has been in the browser, the fix is to rotate it and move the call server-side, a $100 simple fix at Aibrify.

What does the $300 security check include?

The $300 security check examines the whole app over two days for exposed keys, missing sign-in checks, open database rules and unprotected paid endpoints. Each finding comes back with a fixed quote of $100 or $300. Fixes carry a 90-day warranty, and the quote does not change after the check.

How much does it cost to fix what the checklist finds?

Most fixes are $100: seven of the twelve. Two are priced at $100 or $300 by how far a rule needs rebuilding; the three that touch sign-in or payments are $300. An app failing five or more checks fits the $1,000 stabilize package: the top five to eight problems fixed in one to two weeks.

Does Aibrify keep the app secure after the check?

Yes, through two care plans for software Aibrify built or has checked. Care is $49 a month for hosting, monitoring, backups and dependency and security updates; hosting alone stays $10 to $30 a month. Care Plus is $149 a month and adds four hours of changes, next-business-day response and handling of third-party interface changes.

Can the checklist be used on an app Aibrify did not build?

Yes, the checks apply to any app built with Cursor, Lovable, Bolt, Replit, v0 or a similar tool. The $300 security check starts from the code repository or the account login, whichever the owner has. The client owns the code before and after, and a quoted fix Aibrify cannot deliver is not paid for.

What Should You Do Next?

Run checks 1, 5 and 7 today; the exposed table, the key in the front end and the unverified webhook cost real money. Each takes five minutes and needs only a browser and the hosting login.

Text or email Aibrify to request the full $300 security check; access to the code or the hosting account is the only input. The report comes back in two days with a fixed quote for each finding, and the client owns the code afterwards. See the fix and maintain prices or request the check. For an app built with Lovable, see fixing a Lovable app.