Don't Get Hacked: Security Checklist

From the "your vibe-coded app WILL get hacked" video. Bots scan for exposed apps all day — whether you've got 5 users or 5,000. Lock these down before you ship.

1. Exposed API keys & secrets

• No keys, tokens, or secrets hardcoded in frontend / client code (AI does this by default — even native apps get decompiled)
• Keys moved server-side — env vars + a backend or edge function so they never ship to the client
• .env is gitignored so secrets never get committed (viewer tip)
• If your repo is public, treat everything in it as exposed — watch it for accidentally committed secrets (viewer tip)
• Set a spending limit on every API key — if one leaks, the cap limits the damage (a leaked key cost a friend $5k)

2. Input validation

• Every place a user can enter data is validated + sanitized — blocks SQL injection, XSS, and command injection (vibe-coded apps skip this constantly)

3. Open database access — the one most people miss

• Row-Level Security (RLS) turned on for every table
• Policies only let users read and write their own rows
• No table is readable with the public / anon key (this is how the Tea app leaked private messages)

🤖 The audit prompt — paste into your AI:

Audit my app for the 3 most common vibe-coding security holes. For each, show me what you find before you change anything:

1. Exposed API keys — find any keys, secrets, or tokens hardcoded in the frontend or client code. Move them server-side using environment variables and a backend or edge function so they never ship to the client.

2. Input validation — find every place a user can enter data. Add validation and sanitization so inputs can't be used for SQL injection, XSS, or command injection.

3. Open database access — confirm Row-Level Security is enabled on every table, with policies that only let users read and write their own rows. Flag any table that's readable with the public/anon key.

⚠️ General info, not security advice — but these three cover the most common vibe-coding holes.