Vibe coding: a checklist before you launch your app

Why this check is needed

For its 2025 report, Veracode tested code from over 100 models and found a known security flaw in about 45% of tasks. That is no reason to avoid AI, but it is a reason to verify. The tricky part: on screen everything looks right.

1. Secrets

Are API keys or passwords in the code or the browser JavaScript? Open the page and search for them in the developer tools.
Was a .env file ever committed to the repository? Then that value counts as compromised and has to be replaced.
Can the .env on your server be opened by URL? Just try it.

2. Access rights

This is the most common serious fault in AI-built apps. The interface hides a button, but the API checks nothing.

Create two test accounts. Can account A see account B’s data, for instance by changing the ID in the URL?
Can normal users call admin endpoints?
If you use Supabase or Firebase: are Row Level Security or Security Rules really active? The defaults do not always protect the way you might think.

3. Input

Is all input validated on the server, not just in the form?
Are database queries parameterised?
Is user text escaped before output, so that no foreign script runs?
Are upload types and sizes checked, and do files land outside the executable area?
If your app uses a language model: what happens when users try to override its instructions?

4. Accounts and sessions

Use a proven login service rather than storing passwords yourself.
Are login and password reset rate limited?
Do sessions expire, and does logging out really work?

5. Data

Are there automatic backups, and have you ever restored one? An untested backup is not a backup.
Are test and production databases separate? An AI that “quickly recreates the table” should never reach real data.
Do logs contain personal data or tokens?

6. Costs and load

Are budget limits and alerts set for hosting and API providers?
Can users trigger unlimited expensive model calls? With no limit, this can blow up your bill.
What happens with a slow third party: does everything hang, or is there a sensible message?

7. Dependencies

Language models sometimes suggest packages that do not exist or are out of date. Check each new dependency, run npm audit or similar, and remove what nobody uses.

8. Tests for what must not break

You do not need complete test coverage. But sign-in, payment and permission checks should be tested automatically. Tests are also the best brake on an AI that rebuilds something working with your next prompt.

9. Legal and operations

Legal notice, privacy policy and, where needed, consents are in place.
If you send personal data to AI providers: is there a suitable data processing agreement?
Error monitoring is active, so you see problems before your users do.
You know how to roll back to the last working version in an emergency.

What you can ask the AI itself to do

Have the model check its code against the OWASP Top 10 and list the access check for each endpoint. This finds a fair amount but does not replace a second check, since the same model often has the same blind spots. If you want a second person to look at it: code review with tob-apps.

Vibe coding: a pre-launch checklist