Free reference
Ship your vibe-coded app without getting hacked.
You built it with Cursor, Claude Code, Lovable, Bolt, Replit, or v0. The app works. These are the mistakes that still let someone read other people's data, forge a payment, or spend your API budget. Each guide has a five-minute check, a fix, and a prompt you can paste into your coding agent.
- Critical
- 12
- High
- 7
- Medium
- 3
Check these before you share the URL
Ways vibe-coded apps get hacked
Issue index22 of 22 issues
- criticalAccess control
Auth checked only in the UI
Hiding a button or a page does not stop a request. The server, the database policy, or both have to reject it.
Next.js · Supabase · Firebase · Vercel
- criticalSecrets
Exposed .env files and debug endpoints
A public .env, a /api/debug route, or a client bundle that prints config hands your secrets to anyone who asks.
Next.js · Vercel · Supabase
- criticalDatabase
Firebase rules left open
Firestore or Storage rules that allow any read and write make the database public. The client SDK will do whatever the rules allow.
Firebase · Next.js
- criticalAccess control
IDOR: reading or changing someone else's data
The request carries an id, and the server fetches that id without checking that it belongs to the signed-in user.
Next.js · Supabase · Firebase
- criticalSecrets
Keys committed to GitHub
A key in a commit is copied to every clone and to GitHub's history. Deleting the file in a new commit does not remove it.
GitHub · Supabase · Vercel · Next.js
- criticalAI
No cap on LLM API spend
A model route with your key and no limit is a meter anyone can run. One script can spend a month of budget in an afternoon.
Next.js · Vercel
- criticalDatabase
Open storage buckets
A public bucket, or a storage policy of allow-all, lets anyone with the URL read files other users uploaded.
Supabase · Firebase · Vercel
- criticalSecrets
Secret keys shipped in the frontend
A Supabase secret key, Stripe secret key, or model API key in the browser bundle is public. Anyone can copy it and use it as your server.
Supabase · Next.js · Vercel · Stripe · Firebase
- criticalAccess control
Server Actions with no auth check
A Server Action is a public POST. 'use server' does not mean only your button can call it.
Next.js · Supabase · Vercel
- criticalDatabase
Supabase tables without row level security
Tables in the public schema are reachable through the Supabase API. With row level security off, the publishable key is enough to read and change every row.
Supabase · Postgres · Next.js
- criticalPayments
The client sets the price, role, or plan
If the browser can send amount, plan, or role and the server saves it, users will send the values they want.
Stripe · Next.js · Supabase · Firebase
- criticalPayments
Unverified Stripe webhooks
A webhook is a public URL. If you trust the JSON without checking Stripe's signature, anyone can tell your app that a payment succeeded.
Stripe · Next.js · Vercel
- highConfiguration
CORS wide open
Reflecting any website's Origin and allowing credentials means that website can call your API as the logged-in user.
Next.js · Supabase · Firebase · Vercel
- highInjection
Cross-site scripting (XSS)
User content rendered as HTML runs in your origin. It can read that user's data and call your API as them.
Next.js · Supabase · Vercel
- highAccess control
No rate limiting on auth or paid API routes
Login, password reset, and any route that calls a paid API will accept as many requests as an attacker sends, until the bill or the user list gives out.
Next.js · Vercel · Supabase · Stripe
- highAI
Prompt injection in LLM features
Text you feed a model, including user messages and documents it reads, can contain instructions. If the model can call tools, those instructions can become actions.
Next.js · Supabase
- highInjection
SQL injection
User input glued into a SQL string can change the query. The database then runs the attacker's statement with your connection's privileges.
Supabase · Next.js · Postgres
- highInjection
Unsafe file uploads
An upload that trusts the browser's file type, keeps the original name, or serves the file from your site can become stored XSS or a malware host.
Supabase · Firebase · Next.js · Vercel
- highAccess control
Weak password reset
A reset flow that uses a short code, a guessable link, or a client-only check lets someone take the account without the password.
Supabase · Firebase · Next.js
- mediumPrivacy
Missing privacy policy and terms
If you collect accounts, emails, or payments, you need a page that says what you collect and a page that says the rules of the product. This is not legal advice.
Next.js · Supabase · Vercel · Stripe
- mediumConfiguration
Missing security headers
Headers tell the browser not to sniff content, not to load you in a frame, and which scripts are allowed. They limit damage. They do not replace auth.
Next.js · Vercel
- mediumConfiguration
Outdated dependencies
A lockfile full of old packages is a pile of known bugs you have not looked at. Some are security fixes. Some are noise. You still have to look.
GitHub · Next.js · Vercel
Tools directory
13 scanners and services, with a free-tier note only where a public page stated one. Unknowns stay marked unknown.
Printable checklist
One pass before launch. Tick the boxes on paper, or paste the whole list into your coding agent.
Newsletter
Leave an address if you want new guides. A short welcome email follows. See the newsletter page for what that means.