How to Harden Vibe-Coded Next.js 15 & Bolt.new Apps for Production (Supabase RLS + Stripe Webhooks)

You shipped fast. Bolt.new gave you a working app in 20 minutes. Cursor wrote the features while you slept. The demo works.

Then you check Supabase: RLS is disabled on all tables. Stripe webhooks? Not configured. Your users' data and payments are exposed.

This is the "vibe coding" trap: AI generates features, not production guardrails. Here's the 30-minute hardening checklist I use before any AI-built app goes live.

---

The Problem: AI Codes Features, Not Boundaries

Bolt.new and Cursor optimize for speed to demo, not production readiness. They'll give you:

• Working auth flows
• Database schemas
• Payment integration UI

But they skip:

• Row Level Security policies (RLS off by default in Supabase)
• Stripe webhook signature verification
• Idempotency keys for payment retries
• Server-side validation (they trust the client)

---

1. Supabase RLS: The 5 Policies Every App Needs

-- 1. Users only see their own data
CREATE POLICY "Users can view own data" ON public.profiles
  FOR SELECT USING (auth.uid() = id);

-- 2. Users only update their own profile
CREATE POLICY "Users can update own profile" ON public.profiles
  FOR UPDATE USING (auth.uid() = id);

-- 3. Orders: users see only their orders
CREATE POLICY "Users can view own orders" ON public.orders
  FOR SELECT USING (auth.uid() = user_id);

-- 4. Order items: only via orders they own
CREATE POLICY "Users can view own order items" ON public.order_items
  FOR SELECT USING (
    EXISTS (
      SELECT 1 FROM public.orders o
      WHERE o.id = order_items.order_id AND o.user_id = auth.uid()
    )
  );

-- 5. Admins bypass (optional, for support)
CREATE POLICY "Admins full access" ON public.profiles
  FOR ALL USING (
    EXISTS (
      SELECT 1 FROM public.profiles p
      WHERE p.id = auth.uid() AND p.role = 'admin'
    )
  );

Test it: Sign in as User A, try to fetch User B's data. Should return empty.

---

2. Stripe Webhooks: Verify Every Event

// app/api/webhooks/stripe/route.ts
import { headers } from 'next/headers';
import { stripe } from '@/lib/stripe';
import { createClient } from '@supabase/supabase-js';

export async function POST(req: Request) {
  const body = await req.text();
  const signature = headers().get('stripe-signature')!;

  let event;

  try {
    event = stripe.webhooks.constructEvent(
      body,
      signature,
      process.env.STRIPE_WEBHOOK_SECRET!
    );
  } catch (err) {
    console.error('Webhook signature verification failed:', err);
    return new Response('Webhook Error', { status: 400 });
  }

  // Handle the event
  switch (event.type) {
    case 'checkout.session.completed': {
      const session = event.data.object as Stripe.Checkout.Session;
      await fulfillOrder(session);
      break;
    }
    case 'payment_intent.payment_failed': {
      const paymentIntent = event.data.object as Stripe.PaymentIntent;
      await handleFailedPayment(paymentIntent);
      break;
    }
    default:
      console.log(`Unhandled event type: ${event.type}`);
  }

  return new Response(null, { status: 200 });
}

async function fulfillOrder(session: Stripe.Checkout.Session) {
  const supabase = createClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.SUPABASE_SERVICE_ROLE_KEY!
  );

  // Idempotency: check if already processed
  const { data: existing } = await supabase
    .from('orders')
    .select('id')
    .eq('stripe_session_id', session.id)
    .single();

  if (existing) return; // Already processed

  // Create order with RLS-safe service role
  await supabase.from('orders').insert({
    user_id: session.metadata?.user_id,
    stripe_session_id: session.id,
    amount_total: session.amount_total,
    currency: session.currency,
    status: 'paid',
    created_at: new Date().toISOString()
  });
}

Key points:

• Always verify stripe-signature header
• Use STRIPE_WEBHOOK_SECRET from Stripe Dashboard
• Implement idempotency (check stripe_session_id before insert)
• Use Service Role Key for server-side writes (bypasses RLS safely)

---

3. Server-Side Validation: Never Trust the Client

// lib/validators.ts
import { z } from 'zod';

export const createOrderSchema = z.object({
  items: z.array(z.object({
    product_id: z.string().uuid(),
    quantity: z.number().int().positive().max(99),
  })).min(1).max(50),
  shipping_address: z.object({
    name: z.string().min(1).max(100),
    phone: z.string().regex(/^\+?[0-9\s-]{10,15}$/),
    address_line1: z.string().min(5).max(200),
    city: z.string().min(1).max(100),
    postal_code: z.string().regex(/^[0-9]{5}$/),
    country: z.string().length(2).default('ID'),
  }),
});

// In your API route:
export async function POST(req: Request) {
  const body = await req.json();
  const parsed = createOrderSchema.safeParse(body);

  if (!parsed.success) {
    return Response.json({ errors: parsed.error.flatten() }, { status: 400 });
  }

  // Proceed with validated data
}

---

4. Environment Hardening Checklist

Variable	Required	Notes
NEXT_PUBLIC_SUPABASE_URL	✅	Public, safe in client
NEXT_PUBLIC_SUPABASE_ANON_KEY	✅	Public, RLS enforced
SUPABASE_SERVICE_ROLE_KEY	✅	Secret! Server only, bypasses RLS
STRIPE_SECRET_KEY	✅	Secret! Server only
STRIPE_WEBHOOK_SECRET	✅	Secret! From Stripe Dashboard
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY	✅	Public, safe in client

Never commit .env.local. Use Vercel/Netlify environment variables.

---

5. The "Ship Tonight" Checklist (Copy-Paste)

[ ] RLS enabled on ALL tables with policies
[ ] Test: User A cannot read User B data
[ ] Stripe webhook endpoint deployed & verified
[ ] Webhook signature verification implemented
[ ] Idempotency keys on all payment events
[ ] Server-side validation (Zod) on all mutations
[ ] Service Role Key ONLY in server code
[ ] No secrets in client bundle (check network tab)
[ ] Error logging (Sentry/LogRocket) configured
[ ] Stripe test mode → live mode switch verified

---

The Pack: All of This, Pre-Built

I packaged the complete implementation: RLS migration files, webhook handlers, Zod validators, environment template, and a test script that verifies your hardening in one command.

Gumroad ($14.99 → $10.49 with code VIBE30):

https://ancuboy.gumroad.com/l/cursor-bolt-production-hardening-pack

---