Seven security checks to run on a vibe-coded app before launch

An article for developers who built apps with AI coding tools warns that these tools often prioritize functionality over security. It outlines a roughly ten-minute audit covering Supabase row-level security, server-side ownership checks, and payment flows that can be exploited. The author explains how to test whether a logged-out visitor can read tables by calling the Supabase REST API with the public anon key. The piece also advises searching frontend bundles and git history for leaked secret keys, including Supabase service_role keys that bypass all access rules. Each check comes with commands and suggested fixes, such as enabling owner-only policies and moving secrets to server-only code.