DEV Community: Vibe Safe

"I checked 25 AI-built apps for security holes. The same 5 mistakes, every time."

Vibe Safe — Tue, 14 Jul 2026 09:16:04 +0000

I've spent the last few weeks looking at security on apps built with AI tools — Lovable, Bolt, Cursor, Replit, v0. Different people, different products, different stacks. And yet the same five holes show up almost every single time.

None of this is because the tools are bad. It's because an AI coding assistant optimizes for "make the demo work," not "make it safe to put on the internet." Those are different goals, and the gap between them is where you get owned.

Here are the five that keep coming up, what they look like, and how to check your own app.

1. Secret keys sitting in the frontend bundle

The most common one, by a mile. The AI needs to call an API, so it drops the key straight into client-side code:

// This ships to every visitor's browser
const supabase = createClient(url, SERVICE_ROLE_KEY);
const stripe = new Stripe("sk_live_51H...");

Anything in your frontend bundle is public. Open DevTools → Sources, or just view-source, and it's right there. A service_role key or an sk_live_ secret in the browser means anyone can read/write your whole database or hit your payment provider as you.

The nuance that trips people up: not every key is a secret. A Supabase anon key (sb_publishable_...), a Firebase apiKey, or a Stripe publishable key (pk_live_) are designed to be public — they're safe in the frontend as long as your access rules are correct (see #2). The dangerous ones are service_role, sk_live_/sk_test_, and anything labeled "secret."

Check: search your bundle for service_role, sk_live, SECRET, PRIVATE_KEY. If a truly secret key is there, rotate it immediately and move it server-side.

2. Supabase Row Level Security never got turned on

This is the big one for anything using Supabase. You create a profiles or orders table, the app works great in testing… because RLS is off, so every row is readable by anyone with the (public) anon key.

-- Table created, RLS never enabled = the whole table is public
create table orders (id uuid, user_id uuid, total numeric, card_last4 text);

Since the anon key is in the frontend (correctly!), a stranger can open a console and run:

const { data } = await supabase.from('orders').select('*'); // everyone's orders

Check: in the Supabase dashboard, every table under public should say RLS enabled, with policies that actually scope rows to the user (auth.uid() = user_id). "RLS is on" is not enough — a policy of true is the same as off. This exact class of bug is behind a lot of the Lovable/Supabase data leaks people have written up.

3. Auth checks that only exist in the UI

The app hides the admin button unless you're an admin. Feels secure. But the route underneath has no check:

// Frontend hides the link... but the endpoint is wide open
app.post('/api/admin/delete-user', async (req, res) => {
  await db.deleteUser(req.body.id); // no auth check at all
});

Hiding a button is not access control. Anyone can call the endpoint directly with curl.

Check: for every sensitive action (delete, refund, change role, read other users' data), confirm the server verifies who's calling and whether they're allowed — not just the UI.

4. Storage buckets left public

AI tools love to set a storage bucket to public so image uploads "just work." Then user IDs, receipts, or private uploads are all listable by URL.

Check: in Supabase/Firebase storage, buckets holding anything user-specific should be private, served through signed URLs — not public with guessable paths.

5. No security headers on the deployed site

Missing Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, etc. On its own this is lower severity, but it's the difference between a clickjacking/XSS attempt bouncing off and landing.

Check: run your deployed URL through any headers checker, or your browser's DevTools → Network → click the document → Response Headers.

How to actually check all of this

You can go through the list above by hand — and honestly you should understand each one. But when you want a faster pass, there's now a whole category of scanners built specifically for AI-generated apps. They fall into two buckets:

URL scanners that probe your deployed app (good when you don't have/want to share code)
Code-aware scanners that read your source

I actually wrote up an honest side-by-side of the main options — VibeSafe, Vibe App Scanner, CheckVibe, Snyk, Semgrep, AuditYourApp — including which one fits which situation and where each falls short: Best Vibe Coding Security Scanners (2026).

Full disclosure: I work on VibeSafe, one of the tools in that comparison — it scans both code and your live URL and explains issues in plain English, which is why I reach for it. But the comparison is deliberately fair, and for a lot of people Snyk or a free URL scan is the right call. Use whatever gets you to check before you launch instead of after.

The one takeaway

If you built something with AI and you only do one thing from this post: check that your Supabase tables have real RLS policies and that no service_role/sk_live_ key is in your frontend. Those two cover the majority of the serious breaches I've seen in vibe-coded apps.

Ship fast — just check the locks before you hand out the address.

What have you run into on AI-built apps? Drop the weirdest security thing you've found in the comments.

🚀 New in VibeSafe: Launch Check

Vibe Safe — Tue, 07 Jul 2026 06:02:49 +0000

Your app looks finished. But does it actually work when a real person uses it?

Before you share your app with users, clients, or investors — let VibeSafe test it for you. Paste your URL and our AI opens your live app like a real visitor:

✅ Clicks through your pages
✅ Captures screenshots of what users actually see
✅ Catches broken buttons, errors, and slow screens
✅ Gives you a clear launch-readiness score — with the exact fixes, in plain English

No more "it worked on my machine" surprises. Find the problems before your users do.

👉 Try it free at vibesafe.info — built for founders shipping AI-made apps.

vibecoding #buildinpublic #indiehackers #startup #nocode #saas #AI

Your AI-built app may look ready… until a secret key is sitting in plain sight

Vibe Safe — Fri, 03 Jul 2026 07:14:08 +0000

This is the part many new AI builders miss.

The app can run perfectly.
The dashboard can load.
The buttons can work.
The deployment can look successful.

But inside the code, there may still be something dangerous:

A secret key exposed directly in the frontend.

That one small mistake can become a big problem.

It can lead to:

Exposed API access.
Unexpected billing charges.
Private data risks.
Broken user trust.
Security issues before the app even gets real users.

The scary part is that many AI-generated apps do not “look broken” when this happens.

The code may still work.

That is why I am building VibeSafe.

VibeSafe scans AI-built apps for issues like exposed keys, runtime errors, missing packages, weak security patterns, and risky code before launch.

The goal is simple:

Not another confusing security tool.
Not a long report full of jargon.
Just a clear warning before you ship.

Something a beginner can understand:

What is wrong
Why it matters
What to fix next

The image below shows the kind of problem VibeSafe is designed to catch before launch: a hardcoded secret key and a low safety score.

AI is making app development faster than ever.

Now we need to make checking those apps easier too.

Build fast. Ship safe.

Question for developers:
What is the first security check every AI-built app should pass before launch?

Your AI-Built App May Look Ready — But Is It Really Safe?

Vibe Safe — Mon, 29 Jun 2026 15:59:36 +0000

AI tools are helping people build websites and apps faster than ever.

You can create a landing page, dashboard, MVP, or full app much quicker than before.

That is exciting.

But there is one thing many beginners forget:

Just because an app looks ready does not always mean the code is safe.

The hidden problem

When we build fast, we can easily miss important checks.

Some common problems are:

exposed API keys
broken functions
missing packages
runtime errors
weak security rules
forms that do not work properly
code that works in preview but breaks after launch

For experienced developers, these issues may be easier to find.

But for beginners, founders, students, freelancers, and small business owners, these errors can be confusing.

Your website may look fine on the screen.

The design may look good.

The button may work.

But behind the scenes, there may still be hidden problems.

Why this matters

Many people are now using AI to build their first website or app.

That is a great thing because more people can turn their ideas into real products.

But launching without checking the code can create problems later.

A small hidden issue can cause:

broken pages
failed forms
exposed private information
security risks
bad user experience
stress after launch

That is why checking before launch is important.

A simple checklist before launching

Before publishing your website or app, ask yourself:

Are all forms working correctly?
Are there any visible API keys in the code?
Are all required packages installed?
Are there any console errors?
Are pages loading properly?
Are buttons and links working?
Are user data and private settings protected?

These checks may sound technical, but they are very important.

What I am building

I am building VibeSafe, a simple code scanning dashboard for AI-built websites and apps.

The goal is to help users check their code before launch and understand the results in plain English.

No confusing technical language.

No complicated reports.

Just simple feedback that helps users understand what may need fixing.

The mission

The mission is simple:

Build fast. Ship safe.

AI can help us build faster.

But before launching, we should still take a moment to check if the project is safe, stable, and ready.

I would love your feedback

If you build websites, apps, or MVPs, what is the first thing you usually check before launch?

And what would you want a beginner-friendly scanner to check for you?

I’m building VibeSafe and would love honest feedback.

Website: vibesafe.info

“What Beginners Should Check Before Launching an AI-Built App”

Vibe Safe — Fri, 26 Jun 2026 16:14:52 +0000

AI tools have made it easier than ever to build apps quickly.

A founder, student, freelancer, or non-technical creator can now create a landing page, dashboard, MVP, or even a full SaaS idea much faster than before. That is exciting — but it also creates a new problem.

Just because an app works does not always mean it is safe.

When we are building fast, it is easy to focus only on the visible parts:

Does the button work?
Does the page look good?
Does the login open?
Does the dashboard load?
Can I share the link?

But security problems are often hidden. The app may look finished, while small mistakes are sitting quietly in the background.

For beginners, these are some of the most important checks before launch.

1. Check if your API keys are exposed

One of the most common mistakes is accidentally placing secret keys inside frontend code, public repositories, or shared files.

If an API key is visible to users, it can potentially be copied and misused.

Before launch, check:

Are API keys stored in environment variables?
Are secret keys kept out of frontend code?
Is your .env file ignored in Git?
Did you accidentally upload credentials to GitHub?

A simple rule: if the browser can see it, users can see it too.

2. Check your database access rules

Many apps use tools like Supabase, Firebase, or other backend platforms. These tools are powerful, but they still need correct access rules.

A common beginner mistake is assuming the database is private by default.

Before launch, check:

Can one user see another user’s data?
Are database rules enabled?
Are tables protected?
Can users only access their own records?
Are admin-only actions actually restricted?

This matters because user data is one of the most important things your app must protect.

3. Check authentication and user roles

An app also needs to know what each user is allowed to do.

For example:

A normal user should not access admin pages.
One customer should not see another customer’s dashboard.
A logged-out user should not access private routes.
Role checks should happen on the backend, not only in the frontend.

Frontend hiding is not real security. If something is sensitive, protect it on the server side too.

4. Check for broken links, missing packages, and runtime errors

Security is important, but stability matters too.

Before sharing your app publicly, check:

Are there console errors?
Are all packages installed correctly?
Are there broken pages?
Does the app work on mobile?
Does the form submit correctly?
Do error messages expose technical details?

Small errors can reduce trust quickly, especially if this is your first impression with users.

5. Check what happens when something goes wrong

Many beginners test only the happy path.

But real users do unexpected things.

They refresh pages, enter wrong data, upload large files, use weak passwords, click buttons twice, or leave forms empty.

Before launch, test:

Wrong email or password
Empty form fields
Slow internet
Failed payment
Expired session
Unauthorized page access
Invalid file uploads

A safer app is not just one that works. It is one that handles mistakes properly.

6. Check AI-generated code before trusting it

AI can help us build faster, but it should not be treated like a final security reviewer.

AI-generated code may still contain:

weak access control
exposed secrets
missing validation
insecure database rules
outdated package suggestions
logic mistakes

AI is a great assistant, but human review and security checks are still needed.

My simple launch checklist

Before launching any AI-built app, I would check:

No API keys in frontend code
No secrets uploaded to GitHub
Database access rules are enabled
Users can only access their own data
Admin routes are protected
Forms validate user input
Error messages do not leak sensitive details
Dependencies are checked
App works on mobile
Basic security scan is done before launch

Final thought

Building fast is powerful.

But launching safely is what protects your users, your reputation, and your future business.

I am currently exploring this problem while working on VibeSafe, a project focused on helping beginners understand app security issues in simple language.

I would love to learn from the DEV community:

What is one security mistake you think every beginner should check before launching an app?

# Hi DEV Community 👋 I’m New Here

Vibe Safe — Fri, 26 Jun 2026 15:10:42 +0000

Hi everyone,

I’m excited to join the DEV community.

I’m currently learning and building around web development, AI tools, SaaS ideas, and software security. My main interest is helping beginners and non-technical founders understand how to build apps faster, but also make sure they are safe before launch.

I’m also working on a project called VibeSafe, focused on making app security easier to understand in simple language.

I’m here to learn, share my journey, ask questions, and connect with other builders, developers, and founders.

A few things I’m interested in:

AI-built apps
Web app security
SaaS tools
No-code and low-code apps
Beginner-friendly development tips
Startup and product-building lessons

I’m looking forward to learning from this community and sharing useful things along the way.

What is one beginner-friendly security tip you think every new app builder should know?