Ship your AI-built app without leaking data or keys. Practical security notes for people building with AI coding tools.https://vibelocked.comen-ushttps://vibelocked.com/checklists/ship-checklist-for-a-vibe-coded-apphttps://vibelocked.com/checklists/ship-checklist-for-a-vibe-coded-appThe ordered checks to run before you share the URL of an app built with Lovable, Bolt, Cursor, Supabase, or Firebase.Wed, 14 Oct 2026 00:00:00 GMTlaunchchecklistsupabasefirebasenextjshttps://vibelocked.com/guides/check-if-api-key-leaked-on-githubhttps://vibelocked.com/guides/check-if-api-key-leaked-on-githubSearch your repo, your git history, and GitHub's own alerts for exposed keys, then know what to do when you find one.Tue, 13 Oct 2026 00:00:00 GMTsecretsgithubleakshttps://vibelocked.com/guides/nextjs-server-actions-securityhttps://vibelocked.com/guides/nextjs-server-actions-securityServer Actions are public HTTP endpoints. How to add authentication, authorization, and input validation so AI generated actions are safe to ship.Tue, 13 Oct 2026 00:00:00 GMTnextjsserver-actionsauthhttps://vibelocked.com/guides/replit-secrets-guidehttps://vibelocked.com/guides/replit-secrets-guideHow to store API keys in Replit Secrets, read them safely in code, and avoid leaking them through public Repls, frontends, and logs.Tue, 13 Oct 2026 00:00:00 GMTreplitsecretshttps://vibelocked.com/guides/security-review-prompt-for-ai-coding-toolshttps://vibelocked.com/guides/security-review-prompt-for-ai-coding-toolsA copy-paste prompt that asks an AI coding tool for a security review, plus how to read the answer without trusting it blindly.Tue, 13 Oct 2026 00:00:00 GMTcursorpromptreviewhttps://vibelocked.com/guides/supabase-anon-key-vs-service-role-keyhttps://vibelocked.com/guides/supabase-anon-key-vs-service-role-keyWhich Supabase key is safe in the browser, which one bypasses Row Level Security, and where each belongs in a Lovable, Bolt, or Next.js app.Tue, 13 Oct 2026 00:00:00 GMTsupabasesecretsrlshttps://vibelocked.com/guides/common-vibe-coded-app-vulnerabilitieshttps://vibelocked.com/guides/common-vibe-coded-app-vulnerabilitiesHow IDOR, exposed service role keys, and missing auth on API routes show up in apps built with AI coding tools.Mon, 12 Oct 2026 00:00:00 GMTidorauthorizationnextjssupabasehttps://vibelocked.com/checklists/lovable-bolt-pre-launch-security-checklisthttps://vibelocked.com/checklists/lovable-bolt-pre-launch-security-checklistA pre-launch pass for Lovable, Bolt, v0, Cursor, and Replit apps: keys, rules, auth, storage, and payments.Sun, 11 Oct 2026 00:00:00 GMTlovableboltcursorreplitv0https://vibelocked.com/guides/securing-stripe-webhookshttps://vibelocked.com/guides/securing-stripe-webhooksVerify the Stripe-Signature header on the raw body, keep the webhook secret on the server, and ignore duplicate events.Sat, 10 Oct 2026 00:00:00 GMTstripewebhooksnextjshttps://vibelocked.com/guides/keep-secrets-out-of-frontend-codehttps://vibelocked.com/guides/keep-secrets-out-of-frontend-codeWhat Next.js and Vite put in the browser bundle, and where Supabase, Firebase, and Stripe keys actually belong.Fri, 09 Oct 2026 00:00:00 GMTnextjsvitesecretssupabasehttps://vibelocked.com/guides/first-hour-after-an-api-key-leakshttps://vibelocked.com/guides/first-hour-after-an-api-key-leaksRevoke the key first. Then check logs, replace it with less privilege, and clean up git only after the old key is dead.Thu, 08 Oct 2026 00:00:00 GMTsecretsgithubincident-responsehttps://vibelocked.com/checklists/firebase-security-rules-checklisthttps://vibelocked.com/checklists/firebase-security-rules-checklistReplace test mode, stop open rules, and check ownership, queries, and custom claims before you ship Firestore.Wed, 07 Oct 2026 00:00:00 GMTfirebasefirestoresecurity-ruleshttps://vibelocked.com/checklists/supabase-rls-security-checklisthttps://vibelocked.com/checklists/supabase-rls-security-checklistEnable RLS, fix grants, write one policy per operation, and test as anon before you ship a Supabase app.Tue, 06 Oct 2026 00:00:00 GMTsupabaserlspostgres