Vibe-Coded App Security Checklist
AI app-makers get you a working app in an afternoon. They do not decide who is allowed to read your database. Work through 39 checks, starting with a 5-minute test you can run logged out, and see what a stranger could see before they do.
Defensive use only: test apps you own or are authorised to test. Platform terms usually make the customer responsible for the app and its data.
Anyone can run these on their own app, no code needed. If one fails, stop and fix it before you collect more data.
In a browser-to-database app, row-level security (RLS) policies are the access control. If they are missing or too loose, nothing else protects the data.
Login is where "who are you" gets answered. Generated apps often check this in the screen only.
Browser code is public code. Only keys designed to be public may be in it.
Uploads are data too. A public bucket serves files to anyone with the link, and links are guessable or leak.
The more sensitive the data, the less of it you should hold at all.
If your app calls a model, the model's input is untrusted and its output is a request, not a command.
The boring settings that decide what the public internet can reach.
Assume something will go wrong, and make it survivable and visible.
An easy-to-use builder does not remove your duty to protect the data. Read what the terms say you are responsible for.
Your score
0/100 At risk
13 critical check(s) still open. Fix these before anything else.
Ticks are remembered in this browser only. Nothing is sent anywhere.
Top open gaps
TL;DRWhat this tool is
4 points
- 39 concrete checks for apps built with AI app-makers, grouped into: a 5-minute test, database and row-level security, auth, secrets, file storage, payments and personal data, AI features, hosting, backups and incident plan, and ownership.
- Each check says what to look at, why it matters and how to verify it on your own app.
- Get a weighted score out of 100, the open critical gaps first, and copy the whole thing as Markdown for a ticket or a review.
- Free. Runs in your browser; ticks are remembered locally and nothing is uploaded. Use it only on apps you own or are authorised to test.
Frequently asked questions
What is a vibe-coded app?
An app whose code was mostly generated by an AI tool from plain-language prompts, often by someone who does not read the code. Speed is the benefit; the risk is that nobody reviewed who can read or change the data.
Why do apps built this way leak data?
A common cause is a browser-to-database design where access rules (such as Supabase row-level security policies) are missing or too loose, so anyone holding the public key can read tables. In November 2026 German firm Crissy Field reported finding exposed records in apps built on one such platform; see the linked news post. It stresses that access-control mistakes can happen in any application.
Who is responsible for the security of an app I build with an AI tool?
In practice you are. Builder platforms commonly place responsibility for the app and its data on the customer in their terms, regardless of marketing that says no technical skill is needed. Read the terms and assume the review of access permissions is yours to do or to commission.
Is the Supabase anon key a secret?
No. The anon (public) key is designed to be in your front-end code, which is exactly why row-level security must protect every table. The service-role key is different: it bypasses those rules and must never reach the browser.
Can I run the 5-minute test on someone else's app?
No. Only test apps you own or have written permission to test. Requesting other people's data, even read-only, can break the law and the platform's rules.
Is a passing score proof my app is safe?
No. It shows you have covered common, high-impact gaps. Before an app handles real customer or financial data, have someone qualified review access permissions, APIs and separation between accounts, and repeat it after significant changes.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.