The Vibe Coding Security and Compliance Checklist: 12 Checks Before You Launch

02

The 12-point checklist

1. 01

   Row-level access rules on every table (OWASP A01)

   If your app reads the database from the browser (common with Supabase), every table with user data needs row-level security enabled and a policy limiting users to their own rows. Test as an anonymous visitor and as a second account.

2. 02

   No secret keys in the browser or repository

   Search the built JavaScript and the repository for keys. Service-role keys, payment secret keys and AI provider keys belong in server functions and environment variables. Rotate any key that was ever exposed.

3. 03

   HTTPS everywhere, no mixed content (OWASP A04)

   Every page and every request over HTTPS, with HTTP redirected. Mixed content leaks data and is blocked by browsers.

4. 04

   Security headers set (OWASP A02)

   At minimum: Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, and frame-ancestors (or X-Frame-Options) to stop clickjacking.

5. 05

   Auth tokens not exposed (OWASP A07)

   Tokens in localStorage can be read by any script on the page, including a compromised third-party script. Prefer httpOnly cookies where your auth provider supports them, and keep third-party scripts to a minimum.

6. 06

   No unsafe HTML rendering or eval (OWASP A05)

   Rendering user input as HTML (for example with dangerouslySetInnerHTML) or passing it to eval opens the door to cross-site scripting. Sanitise or render as text.

7. 07

   Dependencies current (OWASP A03)

   Run your package manager's audit, update packages with known vulnerabilities, and remove ones you don't use. AI builders add packages generously.

8. 08

   File storage isn't public by accident

   Uploaded avatars and documents often land in a public bucket. Make buckets private unless files are meant for everyone, and serve private files through signed URLs.

9. 09

   Rate limits on sign-in, sign-up and AI endpoints

   Without limits, sign-in can be brute-forced and an AI endpoint can run up your bill or be abused. Most auth providers and hosts offer limits; switch them on.

10. 10

    Collect only what you need

    Data protection by design (GDPR Art. 25) means less data, less risk. Remove form fields and stored columns no feature uses.

11. 11

    A security contact and logging (OWASP A09)

    Publish a way to report vulnerabilities, keep logs that show who accessed what (DPDP Rule 6 expects logs kept for a year), and set alerts for failures.

12. 12

    A breach plan with the deadlines written down

    Who decides, who notifies, which template. GDPR Art. 33: the regulator within 72 hours. DPDP Rule 7: the Board and affected people without delay, detailed report within 72 hours. CERT-In: 6 hours. US states each set their own notification rules.

03

How do I check and fix Supabase row-level security?

In the Supabase dashboard, open the table editor: tables without row-level security are flagged, and the Security Advisor lists them. To fix a table such as profiles where each row belongs to a user:

alter table public.profiles enable row level security;

create policy "Users can read their own profile"
  on public.profiles for select
  using (auth.uid() = id);

create policy "Users can update their own profile"
  on public.profiles for update
  using (auth.uid() = id);

Then test: sign out and query the table with the public key, and query it signed in as a different user. Both should return no other user's rows. Adapt the column (for example user_id instead of id) to your schema.

04

Which laws does each security gap break?

One finding, cited per market. Read how a single finding becomes a fix prompt for your builder.

05

How SafeLaunch checks security

• Code: exposed secrets (redacted before anything is stored), database access rules, unsafe rendering, token storage and dependencies, from a GitHub repository or uploaded .zip.
• Live site: HTTPS, mixed content and security headers on the pages it visits.
• Law: each security finding is mapped to the security provision of every market you choose, alongside privacy, cookie, AI and accessibility findings.
• Every release: scan the new version through the GitHub App in one click, so a new open table is caught before it ships.

Start with a free scan, or read the builder guides for Lovable, Bolt and Cursor.