You shipped a Lovable app on a Sunday. By Wednesday it had a Stripe checkout and one paying customer. Then you opened the browser bundle, searched for service_role, and found your Supabase key sitting in plain text. Every visitor with devtools could read your entire database.
Five checks catch almost all of this before a customer does: secrets in the client bundle, tables without row level security, write routes with no session check, webhooks that trust any caller, and a .env file that got committed. Do them in that order. The first is the fastest to verify and the most expensive to ignore.
How to check for leaked secrets
Build the app, open the output folder, and grep the JS for service_role, sk_live, and SUPABASE_SERVICE. In Next.js, also check every variable prefixed NEXT_PUBLIC_, because that prefix means it ships to the browser. If you find a key, rotate it before you touch the code. A leaked key stays valid until you rotate it, no matter what you commit next.
How to fix a table without RLS
Run this in Supabase:
select tablename, rowsecurity from pg_tables where schemaname = 'public';
Every row showing false is a table anyone holding your anon key can read. Turn RLS on, then write policies for select, insert, update, and delete separately. A select policy does nothing for delete, and that gap is how people lose data.
What to do before you take payments
Call your webhook with curl and no signature header. If it returns 200, someone can mark their own invoice paid. Then check each write route for a session lookup. Any handler that trusts a user id from the request body is an open door.
If you want the short version first, the 15-point check is free: https://probiex.gumroad.com/l/free-vibe-code-safety-check
I packaged the full checklist into a 60-point audit, a read-only CLI that runs 17 checks locally, and fix prompts you can paste into Cursor or Claude. It is the Vibe-Code Rescue Kit: https://probiex.gumroad.com/l/vibe-code-rescue
FAQ
Does the scanner upload my code? No, it reads files locally and prints a report with no API calls or telemetry.
Is this a penetration test? No, it finds the common expensive mistakes in AI-built apps and does not replace a qualified review.
Last updated October 2026 · Probiex.
Top comments (0)