The 10-minute security checklist for vibe-coded apps

Secret keys in your frontend

Only publishable keys (like pk_live_ or a Supabase anon key) belong in the browser. If a secret key (sk_live_, service_role) sits in your app's code, rotate it now and move it to a server-side environment variable.

Wildcard CORS and open API endpoints

Don't let just any website call your API. Restrict it to your own domain instead of allowing all origins, so other sites can't use it with your visitors' access.

Published source maps

Turn off source-map upload in your production build so your original source code isn't downloadable from the live site.

Turn on Row Level Security (Supabase)

Switch RLS on for every table. Without it, anyone holding your public key can read — or change — all of your data.

Lock down public storage buckets

Make buckets private unless a file is truly meant for everyone, and make sure file listing is turned off.

Hide sensitive files

Make sure files like /.env, /.git and database dumps (.sql) can't be opened straight from your live URL.

Add basic security headers

Turn on a few standard headers (HSTS, X-Content-Type-Options and a simple Content-Security-Policy) — most hosts add them with one setting.

Turn on automatic database backups

Enable automated backups (for example Supabase point-in-time recovery or a scheduled dump), then actually try restoring one so you know it works.

Keep your code in Git

Push your project to a private repository so a bad change or a deleted file is always recoverable.