Vibe coding security checklist: a 30-minute pre-launch pass

Five short sections, about 30 minutes. Most time goes to access control, the #1 risk in the OWASP Top 10:2025.

Preview: vibe-coding-security-checklist.md

## 2. Access control (10 min)

Broken Access Control is #1 in the OWASP Top 10:2025. Spend the most time here.

- [ ] Every table in an exposed schema (usually `public`) has Row Level Security enabled.
- [ ] Each table has a policy for each operation the app uses: select, insert, update, delete.
- [ ] **Two-user test:** sign in as user A, copy a request for A's record, and replay it as user B. B must get nothing.
- [ ] Admin routes and API handlers check the role on the server, not just by hiding buttons.
- [ ] File storage buckets are private unless the files are meant to be public.

What's inside

• Secrets, access control, dependencies, inputs, agents and tools
• A final pre-deploy box
• A tested .gitignore for Next.js and Supabase

How to use it

1. Open the checklist next to your app.
2. Tick each box, or write why it doesn't apply.
3. Rename the gitignore to .gitignore if you don't have one.
4. Committed a secret before? Rotate it now.

Who it's for

Solo builders about to put an AI-built app in front of real users.

Related

• How to review AI-generated code before production
• Supabase RLS audit skill
• Pre-deploy check skill