What are the security risks of vibe coding?

The same five show up again and again in AI-built apps: secret keys shipped to the browser, database tables anyone can read because row-level security is off, logins that check the wrong thing, payment webhooks nobody verifies, and no rate limit on sign-up or login. None of them show up in a demo. They show up when a stranger opens your browser's developer tools. Checks 1 to 5, 8 and 14 on this list cover them.

Is my app secure? What's the 5-minute version?

Do three things. View source on your live app and search for sk_, service_role and secret. Log in as one user, copy the link to one of their records, then open it while logged in as a different user. If you're on Supabase, open the Security Advisor and look for the "RLS disabled in public" error. Anything those three steps find is a fix-this-week item. Passing them doesn't make the app secure. It means the most obvious doors are shut.

verified Free Checklist

Is your vibe-coded app actually safe to ship?

In Veracode's July 2025 test of 100+ AI models, AI-written code introduced security flaws in 45 percent of cases across 80 coding tasks. Lovable, Bolt, Cursor and Replit all ship default patterns that break in production. Here's the 20-point self-audit. No developer required.

Make sure you do it right on your own, before launch day finds the holes for you. Updated November 2026.

Justin McKelvey

Former CTO at an AI startup · 50+ products shipped · Austin, TX

What's Inside

check

20 specific checks across secrets, auth, payments, input validation, rate limiting, and data handling

check

The exact tests to run in your browser, no coding required for the diagnostic

check

Per-check "what to do if broken" notes, so you're not just left wondering

check

The single most-expensive miss, based on a $15,000 rescue I did last quarter

No spam. A welcome email, then the weekly email (Tuesdays). One-click unsubscribe.

Before you unlock it

What are the security risks of vibe coding?: The same five show up again and again in AI-built apps: secret keys shipped to the browser, database tables anyone can read because row-level security is off, logins that check the wrong thing, payment webhooks nobody verifies, and no rate limit on sign-up or login. None of them show up in a demo. They show up when a stranger opens your browser's developer tools. Checks 1 to 5, 8 and 14 on this list cover them.
Is my app secure? What's the 5-minute version?: Do three things. View source on your live app and search for sk_, service_role and secret. Log in as one user, copy the link to one of their records, then open it while logged in as a different user. If you're on Supabase, open the Security Advisor and look for the "RLS disabled in public" error. Anything those three steps find is a fix-this-week item. Passing them doesn't make the app secure. It means the most obvious doors are shut.