Before a vibe-coded app goes live, check ten things: no secrets in the pages, logins on everything private, permission checks on every action, visitor input treated as untrusted, safe uploads, locked-down database rules, no debug routes, sensible limits, a short list of dependencies, and a way to undo. Each check below comes with a prompt you can paste so your AI audits its own code.
AI writes code that works. That is not the same as code that is safe, and the gap is predictable: the same handful of mistakes show up in vibe-coded apps again and again. None of them need you to read code to catch. They need you to ask.
1. No secrets in the pages
Anything in your HTML or browser JavaScript can be read by anyone who opens the page. An API key there will be found and used on your bill.
Keys belong on the server, stored as secrets and read by server-side code. On DashPloy that is an environment variable your assistant sets, and its value can't be read back even through the API.
Search the whole project for API keys, tokens and passwords. List every one that appears in code sent to the browser, and move each to a server-side secret.
2. Every private page actually needs a login
The classic vibe-coding bug: the dashboard link is hidden when you are logged out, but the dashboard itself opens for anyone who types the address.
List every page and API route. For each, tell me whether it checks that the visitor is logged in, and add the check wherever it's missing.
3. Every action checks whose data it is
Being logged in is not the same as being allowed. A request to edit order 42 should fail unless order 42 belongs to the person asking.
For every route that reads or changes data, check that it only touches data owned by the logged-in user. Show me any that take an id from the request without checking ownership.
4. Treat everything a visitor sends as untrusted
Form fields, query strings and JSON bodies can contain anything. Validate them on the server, not just in the page, because the page can be bypassed.
Add server-side validation to every form and API input: expected types, lengths and formats. Reject anything else with a clear error.
5. Uploads can't become a weapon
An uploaded file is a file from a stranger. Allow only the types you expect, cap the size, and never serve an upload as if it were your own page. On DashPloy, uploads are served with a policy that stops them running scripts, but your app still decides what it accepts.
Restrict uploads to the file types and sizes this app actually needs, and reject everything else on the server.
6. Lock down the database
If your app talks to a database directly from the browser, the rules on that database are the only thing protecting it. With Supabase, for example, turn on Row Level Security for every table, because the key in the page is public by design.
List every database table this app uses and the rules that protect it. Tell me which tables anyone could read or write without logging in.
7. Remove debug routes and test data
Vibe coding leaves scaffolding behind: test accounts, admin shortcuts, pages that dump data "just for now".
Find any debug, test or admin routes, seeded accounts or hard-coded passwords, and remove them or put them behind a real login.
8. Set limits on anything that costs money or sends messages
A form that sends email, calls an AI API or creates records can be run a thousand times a minute by a script.
Add rate limits to every route that sends email, calls a paid API or writes to the database, and tell me the limits you chose.
9. Keep dependencies few and known
Every package your app pulls in is code you didn't read. Fewer is safer, and well-known beats obscure. DashPloy only offers a curated set of packages to server-side apps, which keeps this short by design.
List every dependency, what it's used for, and whether it's still needed. Remove the ones that aren't.
10. Know how to undo
Something will go wrong eventually. Make sure you can put yesterday's version back in one step, and know where your data lives if you have to.
Tell me how to roll this app back to its previous version, and where its data is stored.
After the checklist
Run it again whenever your app gains a login, a database or uploads. Those are the moments the risk changes, and a one-line request to your AI is cheaper than finding out from a stranger.
When it's ready, hosting for vibe coding covers putting it online, and how to deploy vibe-coded apps and websites walks through it step by step.
Questions people ask
Is vibe-coded code less secure than hand-written code?
Not by nature, but it's written fast and rarely reviewed, so the common mistakes survive. The checklist above is that review.
Can the AI check its own code for security problems?
Yes, and it's good at it when asked a specific question. "Is this secure?" gets a vague answer; "which routes don't check the user is logged in?" gets a list.
Do I need a security expert?
For a small site or tool, usually not. For anything handling payments, health data or other people's private information, get a person who knows security to look at it before you launch.