The vibe coder security checklist

The single most expensive mistake. Stripe keys, OpenAI tokens, AWS secrets, any of them sitting in your source files instead of an .env file is one push away from a compromised account. Bots scrape GitHub for new commits every few minutes.

Find every hardcoded API key or secret in this repo. Move each one to a .env file, replace the hardcoded value with process.env.WHATEVER, and add .env to .gitignore. Then tell me which keys I need to rotate at the provider.

Even when secrets live in .env, that file still gets pushed if you forgot to add it to .gitignore. Check now, not after.

Add .env, .env.local, and .env.*.local to .gitignore. If any .env files are already tracked by git, run git rm --cached on them and commit the change.

Most AI-generated backends ship endpoints that anyone on the internet can hit. Some return user data. Some write to the database. All of them need a session check before they do anything sensitive.

Audit every API route in this project. For each one, add a session check at the top that returns 401 if the user isn't signed in. Skip the obvious public ones like /api/health.

Even with auth, if your endpoint says "give me /api/orders/42" and just trusts the 42, anyone can swap their order ID for someone else's. The real check is "is this order yours," not "are you logged in."

Find every API route that reads a resource by id from the URL. Add an ownership check: confirm the resource belongs to the current user before returning it.

HTTP traffic is readable by anyone between your user and your server. Public Wi-Fi, hostile ISPs, anyone. On most modern hosts the fix is one config line.

Add a redirect from HTTP to HTTPS in this app. If we're on Vercel or Netlify, also set a Strict-Transport-Security header so browsers remember.

A wide-open CORS policy lets any website on the internet make authenticated calls to your API in the background. The fix is naming the exact domains you actually use.

Find the CORS config in this project. Replace any '*' or 'true' values with a list of the specific origins my app uses (production domain plus localhost for dev).

If a route accepts JSON, treat that JSON as hostile until you've validated it. Use Zod or a similar schema library. Don't trust the client to send what you expect.

For each API route in this project, add a Zod schema for the request body and parse it before doing anything else. Return a 400 on parse failure with the validation errors.

If you store user passwords yourself and they aren't hashed with bcrypt or argon2, a database leak hands attackers every account. Plain SHA-256 doesn't count.

Find where I store user passwords. Replace whatever hashing I'm using with bcrypt (cost 12 minimum) and update the login flow to use bcrypt.compare.

A Stripe webhook handler that skips signature verification can be called by anyone claiming any event. Free Pro subscriptions for everyone.

In my Stripe webhook handler, verify the stripe-signature header using stripe.webhooks.constructEvent and the STRIPE_WEBHOOK_SECRET. Reject the request with 400 if verification fails.

Not security, but cheap to fix and required by every payment processor and ad network. Stripe, Google, Apple, and the GDPR and CCPA folks all want to see one before they let you go live.

Generate a basic privacy policy page for my app at /privacy. Cover what data we collect, why, who we share it with (Stripe, analytics), and how users can request deletion. Link to it from the footer.