Vibe-coded app checklist before you launch

This is the longest part, and the one to do first. You can ask your AI tool to work through it item by item. Check the results yourself, though, since it will say it’s done either way.

Secrets

No secrets in the frontend. Anything in your frontend code is public. Keys for OpenAI, Stripe and the like belong on the server. The only database key that belongs in the browser is the public one, like Supabase’s anon key, and never the service role key.

Secrets in Git history. Deleting a key from the code doesn’t delete it from your Git history. If a key was ever committed, rotate it, and keep .env files out of the repo.

Data access

Database access rules. If you use Supabase or Firebase, turn on row level security or security rules for every table. Without them, anyone with your public key can read or change other users’ data. It’s one of the most common problems in vibe-coded apps.

Users only reach their own records. Log in as one user and try to open another user’s record by changing the ID in the URL or the request. If it works, your access rules have a gap.

Fields users can’t change. The server should set fields like role, plan, price and owner, and ignore them when they come from the browser. Otherwise anyone can make themselves an admin with one edited request.

Lean API responses. Return only the fields the page needs. A response with the whole user row can leak emails, internal IDs or password hashes, even if the UI never shows them.

Sensitive data. Store as little as you can. Encrypt anything especially sensitive, like tokens for other services, before it goes in the database.

Auth

Auth on every route. Every API route and server action should check who’s calling it. Hiding a button in the UI doesn’t protect the route behind it.

Passwords. Let your auth provider handle them. If you have to store passwords yourself, hash them with bcrypt or Argon2, never in plain text.

Session cookies. Cookies that hold a session should be HttpOnly, Secure and SameSite, so scripts can’t read them and other sites can’t use them.

Rate limits and bots. Limit login, sign-up and anything that calls a paid API, and add bot protection like Cloudflare Turnstile to public forms. Otherwise one script can run up your AI bill overnight.

Input and output

Validation on the server. Check what users send on the server, not just in the form. Anything that comes from the browser can be changed.

Parameterized queries. Never build SQL by joining strings with user input. Use your ORM or parameterized queries, so input can’t turn into commands.

Escaped user content. Anything users write, like names, comments or bios, should render as text, not HTML. Be careful with dangerouslySetInnerHTML and Markdown renderers.

File uploads. Limit file types and sizes, check them on the server, and keep uploads in private storage unless they’re meant to be public.

Hosting

HTTPS and security headers. Force HTTPS everywhere, and add headers like Content-Security-Policy and Strict-Transport-Security. Most hosts make this a few lines of config.

Dependencies. AI tools sometimes add packages that are old, unused or don’t exist (and someone may have published one with that name since). Remove what you don’t use and runnpm audit.

Page load on a phone. Open your app on a phone over a slow connection. If the first screen takes more than a few seconds, look at image sizes and how much JavaScript loads up front.

Images. Serve images in modern formats and at the size they’re shown. AI tools often drop in the full-size file.

Data fetching. Watch for pages that fetch the same data several times, or load everything at once instead of a page at a time.

Loading and error states. Every screen that waits on data needs both. Turn off your network and click around to see what users would see.

Keyboard. Try to use the app with only Tab and Enter. Every button, link and form field should be reachable, with a visible focus ring.

Labels. Form fields need labels, and icon buttons need a name that screen readers can read.

Contrast. Light gray text on white looks clean and is hard to read. Check your colors with a contrast checker.

Mobile. Check every page at phone width. Look for text that overflows, buttons too small to tap and modals you can’t close.

A repo you own. Your code should live in your GitHub, with version history, not only inside the tool that made it.

One way to do each thing. Look for duplicates, like three button components or two ways to fetch the same data. Each one is a place for bugs to hide.

Rules for the AI. Add a short AGENTS.md file that tells AI tools how the app is structured and what to reuse. It keeps new features from undoing your fixes.

Error tracking. Set up an error tracker like Sentry before launch, so you hear about crashes from a dashboard instead of from users.

Backups. Make sure your database is backed up, and that you know how to restore it.

If most of this passes, you’re in good shape to launch. If a lot of it doesn’t, that’s normal for a vibe-coded app, and most of it can be fixed without starting over.

The guide to fixing a vibe-coded app covers how.

Frontend Supply is a monthly frontend subscription for startups. Vibe-coded apps are welcome, and I clean them up so your team can keep building.

I lead a set of AI agents like a team. I plan the work, set the architecture and component APIs, and correct them when they cut corners or use bad patterns. They work in parallel, so your product gets about 12 hours of work a day.

It’s $5,000 a month, with no contract. You can start with a one-week trial for $1,250 on your own codebase. More about me.

When you’re about to launch and aren’t sure the app will hold up, I make sure it’s ready.

Are vibe-coded apps secure?

They can be, but security is what AI tools skip most often. Check database access rules, secrets and auth on every route before launch.

Can I use AI to check my vibe-coded app?

It helps. Ask it to look for exposed keys, missing auth checks and unused code. Just don’t take its word that everything is fine. Check the important parts yourself, or have someone experienced look.