A pre-launch security checklist for vibe-coded apps

The seven that come first

If the full list feels like a lot, do these seven first. They cover the mistakes that most often end in a data leak, a hijacked account or a surprise bill.

• Keep every API key and secret on the server, never in frontend code.
• Use your database public key on the frontend, never the admin key that skips your security rules.
• Turn on row-level security for every database table.
• Confirm each user can only reach their own records, not just that they are logged in.
• Rate-limit your API, especially login and anything that costs money per call.
• Set billing caps and alerts on every paid service.
• Use parameterized queries so user input can never run as a command.

Paste each prompt into your AI coder one at a time. Review what it changes on each pass.