free guide · comment SAFE

Is your vibe-coded app safe to launch?

You built it with AI in a weekend. Check these five things before real people use it.

AI tools write working code fast, but they often skip the boring safety parts unless you ask. These are the five gaps that show up most in AI-built apps. Each one has a quick check and a prompt you can paste into Claude to check or fix it.

1Hide your secrets

API keys, passwords and tokens sitting in your front-end code or a public repo can be copied by anyone.

Open your live site, press F12, and search the Sources and Network tabs for "key", "secret" and "token".
Secret keys (payments, AI APIs, admin database keys) live only on the server, in environment variables.
Public keys meant for the browser (like a Supabase anon key) are fine only if your database rules are locked (step 2).
If a secret was ever exposed, rotate it (make a new one, delete the old), even if you removed it later.

Prompt: Go through my project and list every API key, token or password. For each one, tell me if it can be seen in the browser or in my git history, and how to move it to a server-side environment variable.

2Lock your database

The most common leak in vibe-coded apps: tables that anyone on the internet can read or edit.

Turn on row-level security (in Supabase: RLS) for every table that holds user data.
Write rules so each user can only read and change their own rows.
Test it: log out, then try to load another user's data. You should get nothing.
Never use an admin or service key in browser code.

Prompt: For every table in my database, tell me who can read, insert, update and delete rows right now, and why. Then write the security rules so users can only access their own data.

3Turn on backups

One bad change, one deleted table, and your users' data is gone.

Enable automatic database backups on your hosting plan, and check how far back they go.
Keep your code in git (GitHub) so you can roll back any change.
Try one restore before launch, so you know it works.

Prompt: Before you change anything, explain exactly what this change will do and how I can undo it. Then make the change in a new version I can roll back.

4Handle errors safely

Raw error messages can reveal how your app works, and crashes lose people's work.

Users see a friendly message, never a stack trace or database error.
Errors are logged privately so you can see what broke (a tool like Sentry, or your host's logs).
Every form checks its input on the server, not only in the browser.

Prompt: Find every place my app can fail. Make sure users see a short friendly message, the real error is logged privately, and every form input is validated on the server.

5Plan for traffic

What happens if a reel goes viral and a thousand people sign up in an hour?

Know your free-tier limits (database rows, function calls, AI credits, emails).
Set billing alerts and spending caps so a spike can't surprise you.
Add rate limits to logins, sign-ups and anything that calls a paid API.

Prompt: If 1,000 people used my app in one hour, what would break first and what would it cost? Add rate limits to anything that calls a paid service.

This checklist covers the common gaps. If your app handles payments, health data or other sensitive personal data, get a professional security review before launch.

More free guides and the AI toolkit

Independent guide by Tool of the Day. Not affiliated with Anthropic or any AI company.