How to Secure Serverless Functions in Vibe-Coded Apps

Quick answer

Serverless functions in vibe-coded apps often lack authentication, input validation, and error handling. To secure them, you must add proper auth checks, validate all inputs, limit function timeouts and memory, and never hardcode secrets. Start by running a free AI app security scanner to catch common misconfigurations.

What to check first

Before diving into code, audit your serverless functions with this checklist:

Step-by-step fix

1. Add authentication middleware

Most serverless platforms (Vercel, Netlify, AWS Lambda) support middleware or wrapper functions. Use a JWT verifier or API key check.

// Example: JWT verification for Vercel serverless function (Next.js API route)
import jwt from 'jsonwebtoken';

export async function middleware(request) {
  const authHeader = request.headers.get('authorization');
  if (!authHeader || !authHeader.startsWith('Bearer ')) {
    return new Response('Unauthorized', { status: 401 });
  }
  const token = authHeader.split(' ')[1];
  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    request.user = decoded;
  } catch (err) {
    return new Response('Invalid token', { status: 401 });
  }
}

For public endpoints that don't need auth, ensure they are idempotent and rate-limited.

2. Validate inputs rigorously

Use a schema validation library like Zod or Joi to enforce types and constraints.

import { z } from 'zod';

const schema = z.object({
  email: z.string().email(),
  amount: z.number().positive().max(10000),
});

export default async function handler(req, res) {
  const result = schema.safeParse(req.body);
  if (!result.success) {
    return res.status(400).json({ error: result.error.issues });
  }
  // proceed with validated data
}

3. Set proper timeout and memory limits

In your serverless configuration file (e.g., vercel.json, netlify.toml, or AWS SAM), define limits:

// vercel.json
{
  "functions": {
    "api/process.js": {
      "maxDuration": 10,
      "memory": 256
    }
  }
}

4. Never hardcode secrets

Use environment variables or a secrets manager. In Vibe-coded apps, secrets often end up in code or config. Scan your repo with a secret leak scanner to catch any exposed keys.

5. Add rate limiting

Serverless functions can be invoked rapidly, leading to abuse or cost spikes. Use a rate limiter library or service.

import rateLimit from 'express-rate-limit';

const limiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 100, // limit each IP to 100 requests per window
});

Common mistakes

FAQ

How do I add authentication to a serverless function in a vibe-coded app?

Use a middleware pattern. In Next.js API routes, create a middleware.js file that checks for a valid JWT or API key before the route handler runs. Alternatively, wrap each handler with an authentication function.

What is the most common security flaw in vibe-coded serverless functions?

Lack of authentication. Many AI-generated functions are designed to be called from a frontend without any token verification, making them accessible to anyone who discovers the endpoint.

Can I use environment variables for secrets in serverless functions?

Yes. Store secrets in your platform's environment variable settings (Vercel, Netlify, AWS). Never hardcode them in your code. Use a secrets scanner to check for any leaked keys in your repo.