Is my checklist data sent anywhere?

No. The tool is entirely client-side JavaScript — ticks, score, and the generated report exist only in your browser tab. Nothing is stored or transmitted.

What score is safe to launch with?

18 or higher out of 20, with no fails in Secrets & Keys or Database. Those two categories hold the failures that leak data or money; the rest degrade gracefully.

How do I verify each item, not just guess?

Every item links to a guide with a concrete verification command — curl tests for auth, SQL for RLS, gitleaks for history. The written checklist guide walks through all 20.

Can I use the generated report with my AI coding tool?

Yes — that is what the markdown export is for. Paste the failing items into Cursor, Claude Code, or Lovable and ask it to fix each one. Then re-verify; do not trust "done" on faith.

Tools / 01

Vibe code security checklist

The 20 checks I run first on every paid audit. Tick what you've verified — not what you hope is true — and the verdict updates live.

Secrets & Keys

No API keys in client code Anything shipped to the browser is public — keys must live behind a server route or edge function. Guide →
.env files are gitignored One committed .env is a permanent leak; git history remembers forever. Guide →
Git history scanned for secrets A deleted .env is still in history. Run gitleaks; rotate anything it finds. Guide →
Separate dev and prod keys A leaked dev key should never open production. Guide →

Auth & Access

Every API route checks auth server-side Hiding a button is UI, not authorization — test routes with a logged-out curl. Guide →
Authorization is per-record, not just per-login User A must not fetch user B’s data by changing an ID in the URL (IDOR). Guide →
Sessions expire and can be revoked Tokens without expiry turn one stolen laptop into a permanent breach. Guide →
Admin routes protected by role, not obscurity Secret URLs get found; the server must check a role claim every time. Guide →

Database

Supabase RLS enabled on every table Your anon key is public by design — RLS is the only lock on the database. Guide →
RLS policies tested with a second account A wrong policy fails silently; only a second user proves it works. Guide →
Backups enabled and restore tested A backup you’ve never restored is a hypothesis, not a backup. Guide →
Input validated server-side Form validation is UX — anyone can bypass it with curl. Guide →

Deploy & Infra

HTTPS enforced (HTTP redirects) Certbot makes this one command; there is no excuse in 2026. Guide →
Security headers set CSP, nosniff, frame and referrer policies shut down whole bug classes for free. Guide →
Rate limiting on auth + expensive endpoints Login endpoints get credential-stuffed; AI endpoints get farmed. Both cost you. Guide →
Dependencies audited AI tools sometimes pin packages with known CVEs — npm audit takes a minute. Guide →

Reliability

Errors don’t leak stack traces Internals belong in your logs, not in response bodies attackers can read. Guide →
Monitoring / alerting exists Without it, your users are your alerting system. Guide →
Payment webhooks verify signatures An unverified Stripe webhook lets anyone grant themselves your product. Guide →
A rollback path exists The fix for a bad deploy should be five minutes, not a 2 a.m. debugging session. Guide →

What this checklist covers, and why these 20

These aren't twenty theoretical best practices — they're the checks that catch actual failures in AI-built apps. The list is weighted toward the two categories where I find critical findings most often in paid audits: secrets handling (because AI tools take the shortest path to "it works", which often means a key in the browser) and database access (because Supabase's public-anon-key model makes Row Level Security load-bearing, and generated code skips it).

The right way to use it: don't tick an item because it's probably fine. Tick it after you've run the verification — a logged-out curl against your API, the RLS query in the SQL editor, gitleaks over your history. The written companion guide has the exact command for every item. An honest 14/20 is worth more than a hopeful 20/20.

When you have fails you can't fix yourself, copy the report and paste it into your AI tool as a work order — each line is phrased so Cursor or Claude Code knows what to do with it. Or send it to me with your repo and I'll fix them for a fixed price.

FAQ

Questions people ask

Is my checklist data sent anywhere?: No. The tool is entirely client-side JavaScript — ticks, score, and the generated report exist only in your browser tab. Nothing is stored or transmitted.
What score is safe to launch with?: 18 or higher out of 20, with no fails in Secrets & Keys or Database. Those two categories hold the failures that leak data or money; the rest degrade gracefully.
How do I verify each item, not just guess?: Every item links to a guide with a concrete verification command — curl tests for auth, SQL for RLS, gitleaks for history. The written checklist guide walks through all 20.
Can I use the generated report with my AI coding tool?: Yes — that is what the markdown export is for. Paste the failing items into Cursor, Claude Code, or Lovable and ask it to fix each one. Then re-verify; do not trust "done" on faith.