12 things to check before you ship your vibe-coded app

Short summary

A practical 12-item security checklist for apps built with AI coding tools like Lovable, Bolt, and v0. Citing data that 98% of scanned vibe-coded Supabase apps had security issues and 16% had critical ones, the author walks through concrete curl and devtools checks for exposed .env files, .git directories, leaked secrets, missing RLS policies, absent security headers, source maps, debug routes, and rate limiting. Every check is runnable in fifteen minutes with no specialized tooling.

• •98% of scanned AI-generated apps had security issues; 16% had critical vulnerabilities
• •Checklist covers .env exposure, .git leaks, secrets in bundles, missing RLS, security headers, source maps, debug routes, and rate limiting
• •All checks runnable with curl and browser devtools in about fifteen minutes

Generated with AI, which can make mistakes.