How do I secure a vibe coded app?
Check what the AI left open before real users arrive. AI-built apps often work perfectly and still let anyone read other people's data. Start with access rules, keys in the browser and database permissions.
Check these first
- Server-side access checks. Log in as one user and try to open another user's record by changing the ID in the address.
- Database rules. If you use Supabase or Firebase, confirm row-level security or security rules are on for every table.
- Keys in the browser. Only public keys belong in frontend code. Service keys must stay on the server.
- Payments. Set prices on the server, never from a value the browser sends, and verify webhook signatures.
- Rate limits. Limit logins and anything that costs you money, such as AI calls.
- Packages. Confirm each package exists and is the one you meant to install, then run a dependency audit.
Can I ask AI to check AI's code?
Yes, and it finds a lot, especially when it reads the whole project rather than one file. Review each fix yourself, and test the access rules by hand.
Check your whole codebase
Cyber mode reads your code, finds the holes and tells you what to fix first. You approve every fix. Use it only on code you own or may test, and review each change, because AI can miss issues.