Vibe coding security checklist (2026): ship-ready gate

Before you share a Lovable, Bolt, Replit, Cursor, v0 or Vercel app, walk this hub checklist on the live production URL: secrets, database rules, security headers, exposed files, CORS and a simple monitoring loop. Every item links to a deeper StackSiren guide so you can fix what fails.

“Vibe coding” ships UI fast. It does not automatically ship least-privilege data access, header packs or secret hygiene. Use this page as a gate — the same way how to test website security before launch frames a pre-launch pass — then drill into builder-specific lists for Cursor and v0. Only test sites and projects you own.

How to run this checklist

• Use the production hostname, not localhost, an IDE preview, or an unprotected PR deploy (unless you are deliberately testing that preview).
• Keep a browser (signed out) and a terminal with curl.
• Replace yourapp.com below with your real domain.
• Tick a section only when the live URL passes — not when the chat agent says it did.

Builder hubs: Lovable, Bolt, Replit, Cursor, v0, Vercel.

1. Secrets — nothing secret in the browser

Pass when: the shipped JS only contains publishable identifiers (Stripe pk_, Supabase anon / sb_publishable_, Firebase web apiKey). Fail when you see sk_, sk-, sb_secret_, service_role, AKIA, ghp_, service-account JSON, or raw .env contents.

Do this

1. View source + DevTools search across all loaded scripts for those prefixes.
2. Confirm VITE_ / NEXT_PUBLIC_ variables are not holding secrets (Vite, Next.js).
3. Provider keys live in server/Edge only: Supabase Edge Function secrets, Netlify Functions, Route Handlers.
4. If something leaked: rotate first — OpenAI, Stripe, Supabase service_role.

Guides / tools: exposed API keys · exposed API key checker

Firebase note: a Firebase web apiKey is public by design — protect data with Rules + App Check (Is a Firebase API key safe?). A Gemini Developer API key is not.

2. Database — RLS / Security Rules actually deny

Pass when: a signed-out client cannot read private rows; user A cannot read user B's rows; Storage buckets that should be private are not world-listable.

Do this

1. Enable RLS (or Firebase Rules) on every exposed table / path — Supabase RLS guide.
2. Replace USING (true) “open” policies (USING (true) explained).
3. Prove with two users (RLS two-user test) and know what 42501 is telling you.
4. Builder recipes: Lovable + RLS, Bolt + RLS.
5. Check Storage: public bucket guide. Confirm anon key vs service_role.

Tools: Supabase RLS checker

3. Headers — CSP, HSTS, framing, nosniff

Pass when: curl -sI https://yourapp.com/ shows Strict-Transport-Security, X-Content-Type-Options: nosniff, framing defence (X-Frame-Options and/or CSP frame-ancestors), and a sensible Referrer-Policy. Prefer a real Content-Security-Policy once rolled out carefully.

curl -sI https://yourapp.com/ | grep -iE \
  'strict-transport|x-content-type|x-frame|referrer-policy|content-security|permissions-policy'

Do this

1. Host recipes: Vercel, Netlify, Lovable, Replit (server/helmet).
2. Framing: X-Frame-Options vs frame-ancestors.
3. HSTS: What is HSTS?.
4. CSP deep dive: CSP for React + Vite.

Guides / tools: security headers · security headers checker

4. Files — no public .env, .git, or debug maps

Pass when: https://yourapp.com/.env, /.git/config, and production .map files are not readable (404/403). Fail on 200 with secrets or full source.

Do this

1. Is my .env file public? and the exposed .env / .git guide.
2. Exposed .git folder — treat a readable repo as a full secret incident.
3. Turn off public production source maps: disable Vite source maps, exposed source maps guide.
4. Bolt → Netlify env hygiene: Bolt env vars on Netlify. Replit: Are Replit Secrets safe?.

Tools: env file checker

5. CORS — no credentialed wildcards

Pass when: APIs that use cookies or Authorization do not reflect arbitrary Origin values with Access-Control-Allow-Credentials: true. A public read-only CDN response with Access-Control-Allow-Origin: * and no credentials can be fine.

Do this

1. Read Is Access-Control-Allow-Origin: * safe? and the CORS misconfiguration guide.
2. Allowlist exact front-end origins on Edge Functions, Netlify Functions and Express cors().
3. Retest preflight (OPTIONS) after every origin change.

6. Monitoring — rescans after every deploy

Pass when: you have a habit, not a one-off. AI edits reintroduce VITE_ secrets, open policies and dropped headers.

Do this

1. After each production deploy: free StackSiren scan on a site you own + the four focused tools above.
2. Keep Builder ($79/mo) or Solo ($29/mo) scheduled rescans when you ship weekly; Pro ($159/mo) includes Deep Scan for authenticated passes. Deep Scan is also $49 one-off or $99/mo as an add-on.
3. Re-run the two-user RLS test when you add tables. Re-curl headers when you touch vercel.json / _headers / helmet.

Never rely on a chat transcript as proof. The live URL is the evidence.

Section map (print or paste into your issue tracker)

#	Gate	Primary guide	Focused tool
1	Secrets	/issues/exposed-api-keys	/tools/exposed-api-key-checker
2	Database	/issues/supabase-rls	/tools/supabase-rls-checker
3	Headers	/issues/security-headers	/tools/security-headers-checker
4	Files / maps	/issues/exposed-env-files, /issues/exposed-source-maps	/tools/env-file-checker
5	CORS	/issues/cors-misconfiguration	headers tool + manual preflight
6	Monitoring	this page + pre-launch test	free scan / Builder

Related reading

• How to test website security before launch
• Cursor app security checklist
• v0 app security checklist
• Supabase Edge Function secrets
• Is a Firebase API key safe?

FAQ

Is this only for Supabase apps? No. Secrets, headers, .env/.git, CORS and monitoring apply everywhere. Swap the database section for Firebase Rules (or your ORM's authz) when you are not on Supabase.

Do I need Deep Scan to ship? Many vibe-coded apps can clear a first launch with the free passive scan plus this checklist. Use Deep Scan when you need authenticated or deeper checks on an app you own.

How often should I re-run it? After every production deploy at minimum, and whenever you add a table, a provider key or a new custom domain.

What plan is this checklist aimed at? Start with the free first scan. When you want scheduled rescans while you iterate daily, Builder is $79/mo (Solo is $29/mo). Prices are on /pricing.

Can Agent “just fix everything”? Agent can draft helmet, RLS SQL and _headers. You still prove each gate on the live URL. StackSiren's first scan is free and passive on sites you own — use it as the external second opinion after Agent finishes.