# VibeLocked

> Ship your AI-built app without leaking data or keys. Practical security notes for people building with AI coding tools. Independent of Lovable, Bolt, v0, Cursor, Replit, Supabase, Firebase, Stripe, and Vercel. Articles cite official docs and do not invent incidents or statistics.

VibeLocked is a static site. Pages are written for people shipping AI-built apps and for answer engines that need a primary source. Prefer the full article URL over this index when you quote a procedure.

## Checklists
- [Ship checklist for a vibe-coded app](https://vibelocked.com/checklists/ship-checklist-for-a-vibe-coded-app): The ordered checks to run before you share the URL of an app built with Lovable, Bolt, Cursor, Supabase, or Firebase.
- [Lovable and Bolt pre-launch security checklist](https://vibelocked.com/checklists/lovable-bolt-pre-launch-security-checklist): A pre-launch pass for Lovable, Bolt, v0, Cursor, and Replit apps: keys, rules, auth, storage, and payments.
- [Firebase security rules checklist](https://vibelocked.com/checklists/firebase-security-rules-checklist): Replace test mode, stop open rules, and check ownership, queries, and custom claims before you ship Firestore.
- [Supabase RLS security checklist](https://vibelocked.com/checklists/supabase-rls-security-checklist): Enable RLS, fix grants, write one policy per operation, and test as anon before you ship a Supabase app.

## Guides
- [How to check if your API key leaked on GitHub](https://vibelocked.com/guides/check-if-api-key-leaked-on-github): Search your repo, your git history, and GitHub's own alerts for exposed keys, then know what to do when you find one.
- [Next.js Server Actions security](https://vibelocked.com/guides/nextjs-server-actions-security): Server Actions are public HTTP endpoints. How to add authentication, authorization, and input validation so AI generated actions are safe to ship.
- [Replit Secrets guide](https://vibelocked.com/guides/replit-secrets-guide): How to store API keys in Replit Secrets, read them safely in code, and avoid leaking them through public Repls, frontends, and logs.
- [A security review prompt for AI coding tools](https://vibelocked.com/guides/security-review-prompt-for-ai-coding-tools): A copy-paste prompt that asks an AI coding tool for a security review, plus how to read the answer without trusting it blindly.
- [Supabase anon key vs service role key](https://vibelocked.com/guides/supabase-anon-key-vs-service-role-key): Which Supabase key is safe in the browser, which one bypasses Row Level Security, and where each belongs in a Lovable, Bolt, or Next.js app.
- [Common vulnerabilities in vibe-coded apps](https://vibelocked.com/guides/common-vibe-coded-app-vulnerabilities): How IDOR, exposed service role keys, and missing auth on API routes show up in apps built with AI coding tools.
- [Securing Stripe webhooks](https://vibelocked.com/guides/securing-stripe-webhooks): Verify the Stripe-Signature header on the raw body, keep the webhook secret on the server, and ignore duplicate events.
- [Keep secrets out of frontend code](https://vibelocked.com/guides/keep-secrets-out-of-frontend-code): What Next.js and Vite put in the browser bundle, and where Supabase, Firebase, and Stripe keys actually belong.
- [The first hour after an API key leaks](https://vibelocked.com/guides/first-hour-after-an-api-key-leaks): Revoke the key first. Then check logs, replace it with less privilege, and clean up git only after the old key is dead.

## Site
- [Home](https://vibelocked.com/): The promise, latest checklists and guides, sponsor slot, and newsletter placeholder.
- [Checklists index](https://vibelocked.com/checklists): All launch checklists.
- [Guides index](https://vibelocked.com/guides): All launch guides.
- [Sponsor](https://vibelocked.com/sponsor): Media kit. Contact sponsors@vibelocked.com. No invented traffic numbers.
- [About](https://vibelocked.com/about): Independence, funding, and corrections.
- [Newsletter](https://vibelocked.com/newsletter): Weekly note. The signup form does not store email yet.
- [Privacy](https://vibelocked.com/privacy): No analytics cookies in this version.
- [RSS](https://vibelocked.com/rss.xml): Article feed.

## Optional
- [llms.txt specification](https://llmstxt.org/): Format used by this file.