The 10-Point Vibe Code Risk Checklist

1. Exposed API Keys & Secrets

Open dev tools -> Network tab while using your app. If you see API keys for OpenAI, Stripe, Supabase, or similar in requests made from the browser, they're exposed to anyone. Move them to a server-side function.

2. Public Database Read/Write Rules

If you're on Supabase or Firebase, check your Row Level Security / security rules. The default during vibe coding is often wide open — anyone with your project URL can read or write your data.

3. Missing Auth Checks on Admin Actions

Test what happens if you hit an admin or delete endpoint while logged out, or logged in as a regular user. If it works, you have a broken access control issue — one of the most common real-world breaches.

4. CORS Wide Open

Check your API's CORS headers. Access-Control-Allow-Origin: * on anything that touches user data means any website can call your API from a visitor's browser.

5. No Rate Limiting on Forms or Login

Try submitting a form or login attempt rapidly. If nothing stops you, you're exposed to spam, credential stuffing, and abuse of any paid API calls behind that form.

6. Outdated or Vulnerable Dependencies

Run npm audit (or ask your AI tool to). Vibe-coded projects often pull in whatever package version was suggested, without ever checking for known vulnerabilities.

7. Sensitive Data in Client-Side Code

View page source and any bundled JS. Look for hardcoded emails, internal URLs, comments, or logic that reveals more about your backend than a visitor should see.

8. HTTPS Everywhere

Confirm every page and API call uses HTTPS, not just your homepage. Mixed content is a common miss on custom domains connected to AI-builder platforms.

9. Error Messages Leaking Info

Trigger an error on purpose — bad input, wrong password. If the response includes stack traces, database names, or file paths, you're handing attackers a map.

10. No Backup or Recovery Plan

If your database got wiped or corrupted right now, could you restore it? Many AI-builder platforms don't back up by default — confirm yours does, or set up your own.