How to Secure an AI Coded App: A Checklist for Vibe Coders

Quick answer

Securing an AI-coded app doesn't require a security degree, but it does require a checklist. The most common vulnerabilities in vibe-coded apps are exposed secrets, missing authentication checks, insecure database rules, and weak dependency hygiene. Focus on these four areas first, and you'll eliminate the majority of real-world attack vectors.

What to check first

Before you do anything else, run through this checklist. It targets the issues that show up most often in AI-generated code.

Step-by-step fix

Once you've identified the issues, here's how to fix them. I'll walk through the most critical ones.

1. Fix exposed secrets

If you find a hardcoded API key or secret, remove it immediately and rotate the key. Move it to environment variables. In Next.js, you can use .env.local for local development and set them in your hosting platform (Vercel, Netlify, etc.) for production.

Here's an example of how to properly use environment variables in a Next.js app:

// .env.local
OPENAI_API_KEY=sk-...

// pages/api/openai.js
export default async function handler(req, res) {
  const apiKey = process.env.OPENAI_API_KEY;
  // Use apiKey to call OpenAI
}

Never commit .env files to your repository. Add them to .gitignore.

2. Lock down your database rules

If you're using Firebase or Supabase, review your security rules. For Firebase, you might have something like this:

{
  "rules": {
    ".read": true,
    ".write": true
  }
}

This is a disaster waiting to happen. Change it to something like:

{
  "rules": {
    "users": {
      "$uid": {
        ".read": "auth != null && auth.uid == $uid",
        ".write": "auth != null && auth.uid == $uid"
      }
    }
  }
}

For Supabase, use Row Level Security (RLS). Write policies that restrict access to the owner of the data. For example:

create policy "Users can only access their own data"
on profiles for select
using ( auth.uid() = user_id );

3. Add authentication checks to API routes

AI-generated code often forgets to check if the user is authenticated. In Next.js API routes, add a check at the top:

import { getSession } from 'next-auth/react';

export default async function handler(req, res) {
  const session = await getSession({ req });
  if (!session) {
    return res.status(401).json({ error: 'Unauthorized' });
  }
  // Proceed with the rest of the handler
}

Make sure to do this for every route that accesses sensitive data or performs mutations.

4. Set security headers

You can add security headers manually in your hosting config. For Vercel, you can use a vercel.json file:

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        { "key": "Content-Security-Policy", "value": "default-src 'self'" },
        { "key": "X-Frame-Options", "value": "DENY" },
        { "key": "Strict-Transport-Security", "value": "max-age=31536000; includeSubDomains" }
      ]
    }
  ]
}

Alternatively, use a security headers checker to see what's missing and then implement them.

5. Update dependencies

Run npm audit and fix any critical vulnerabilities. If a package has no fix, consider replacing it. For example, if you're using a vulnerable version of lodash, update it or switch to a modern alternative.

Common mistakes

Here are the mistakes I see all the time in vibe-coded apps:

How to keep your app secure over time

Security isn't a one-time fix. As you continue to add features with AI, new vulnerabilities can creep in. Here's how to stay on top:

FAQ

What is the most common security issue in AI-coded apps?

The most common issue is exposed secrets. AI models often generate code with hardcoded API keys or database credentials. Always scan your repo for secrets before deploying.

Do I need a pentest for my vibe-coded app?

Not necessarily. For a small app, a vulnerability scan and manual review of the checklist above is usually enough. Pentests are more appropriate for larger apps with sensitive data.

How can I scan my AI-coded app for free?

You can use OverMCP's free AI app security scanner to check for common vulnerabilities. It's built for indie developers and takes less than a minute to run.

---

By following this guide, you'll significantly reduce the risk of a security breach in your AI-coded app. Remember, security is a journey, not a destination. Keep scanning, keep fixing, and ship with confidence.