# VibeLocked

> Ship your AI-built app without leaking data or keys. Practical security notes for people building with AI coding tools. Independent of Lovable, Bolt, v0, Cursor, Replit, Supabase, Firebase, Stripe, and Vercel. Articles cite official docs and do not invent incidents or statistics.

VibeLocked is a static site. Pages are written for people shipping AI-built apps and for answer engines that need a primary source. Prefer the full article URL over this index when you quote a procedure.

## Checklists
- [Ship checklist for a vibe-coded app](https://vibelocked.com/checklists/ship-checklist-for-a-vibe-coded-app/): The ordered checks to run before you share the URL of an app built with Lovable, Bolt, Cursor, Supabase, or Firebase, from leaked keys to payments.
- [Lovable and Bolt pre-launch security checklist](https://vibelocked.com/checklists/lovable-bolt-pre-launch-security-checklist/): A pre-launch security pass for Lovable, Bolt, v0, Cursor, and Replit apps: exposed keys, database rules, auth, storage, and payments before you share the URL.
- [Firebase security rules checklist](https://vibelocked.com/checklists/firebase-security-rules-checklist/): Replace test mode, stop open Firebase security rules, and check ownership, queries, and custom claims before you ship Firestore.
- [Supabase RLS security checklist](https://vibelocked.com/checklists/supabase-rls-security-checklist/): Enable RLS, fix table grants, write one policy per operation, and test as the anon role before you ship a Supabase app built with Lovable, Bolt, or Cursor.

## Guides
- [Client-side auth is not security: protect your admin page](https://vibelocked.com/guides/client-side-auth-admin-page-security/): A JS role check, localStorage flag, or email gate only hides your admin page. Enforce roles on the server with Supabase RLS, Next.js, Firebase, or Clerk.
- [How to hide API keys in an Expo or React Native app](https://vibelocked.com/guides/expo-react-native-api-keys-secrets/): EXPO_PUBLIC_ and .env values ship inside your app. Which keys are safe in a mobile bundle, and how to move OpenAI and secret keys to a server proxy.
- [Stop brute force and credential stuffing on your login](https://vibelocked.com/guides/login-brute-force-protection-supabase-clerk-firebase-authjs/): Rate limits, CAPTCHA, lockout, and MFA for Supabase, Clerk, Firebase, and Auth.js logins, plus generic errors and a safe way to test your own app.
- [MCP server security: what to check before you install one](https://vibelocked.com/guides/mcp-server-security-cursor-claude-code/): Before you add an MCP server to Cursor, Claude Code, or VS Code: tool poisoning, prompt injection, rug pulls, leaked tokens, and settings that limit damage.
- [Fix 'infinite recursion detected in policy for relation' in Supabase](https://vibelocked.com/guides/supabase-rls-infinite-recursion-policy-fix/): Why Supabase RLS throws 42P17 infinite recursion, the safe private security definer fix, and the AI quick fixes that quietly open your data.
- [Supabase Security Advisor warnings explained and fixed](https://vibelocked.com/guides/supabase-security-advisor-warnings-fix/): What each Supabase Security Advisor lint means, which ones are urgent, and the SQL fix: RLS disabled, mutable search_path, definer views, and more.
- [Firestore allow read, write: if true makes your data public](https://vibelocked.com/guides/firestore-security-rules-allow-read-write-if-true/): What Firebase test mode and if true rules really allow, how to check whether your Firestore or Storage is open to the public, and the rules to deploy instead.
- [SQL injection in Prisma, Drizzle, and Supabase](https://vibelocked.com/guides/sql-injection-prisma-drizzle-supabase-nextjs/): Fix SQL injection in Prisma, Drizzle, and Supabase: tagged templates, never sql.raw with user input, and parameterize Postgres functions called via rpc.
- [Supabase Edge Function auth: verify JWT and callers](https://vibelocked.com/guides/supabase-edge-functions-auth-verify-jwt/): Secure Supabase Edge Functions: what verify_jwt does not prove, getClaims vs getUser, secret key safety, signed webhooks, CORS, and rate limits.
- [Supabase Realtime authorization: private channels and RLS](https://vibelocked.com/guides/supabase-realtime-authorization/): Secure Supabase Realtime: private channels, RLS on realtime.messages for Broadcast and Presence, postgres_changes, and vibe-coded mistakes.
- [Supabase Realtime: broadcast from the database](https://vibelocked.com/guides/supabase-realtime-broadcast-from-database/): Harden Supabase Realtime broadcast from Postgres: realtime.send, broadcast_changes, private channels, payload leakage, and vibe-coded trigger mistakes.
- [Supabase views and functions that bypass RLS](https://vibelocked.com/guides/supabase-views-security-definer-bypass-rls/): Fix Supabase views and SECURITY DEFINER functions that skip RLS: set security_invoker, pin search_path, revoke EXECUTE, and test as anon.
- [How to test Supabase RLS policies in CI with pgTAP](https://vibelocked.com/guides/test-supabase-rls-policies-ci/): Test Supabase RLS with pgTAP and supabase test db: block anon and cross-tenant access, fail CI on tables without RLS, and run it all in GitHub Actions.
- [AI hallucinated packages and slopsquatting](https://vibelocked.com/guides/ai-hallucinated-packages-slopsquatting/): AI coding tools sometimes suggest npm or PyPI packages that do not exist, and attackers register the names. How it works, and a quick check before you install.
- [AUTH_SECRET and NEXTAUTH_SECRET: set and rotate](https://vibelocked.com/guides/authjs-auth-secret-nextauth/): Auth.js needs AUTH_SECRET (NEXTAUTH_SECRET in older NextAuth) on the server only. What it encrypts, how to generate a strong value, and how to rotate it safely.
- [CORS misconfiguration in vibe-coded apps](https://vibelocked.com/guides/cors-misconfiguration-vibe-coded-apps/): AI tools often 'fix' CORS errors by allowing every origin or turning on credentials. What is dangerous in Next.js, Express, and Supabase, plus safe configs.
- [Content-Security-Policy for vibe-coded apps](https://vibelocked.com/guides/csp-content-security-policy-vibe-coded-apps/): Where to set a CSP header on Next.js, Vercel, and static hosts, a starter policy, what breaks with Stripe, Clerk, and Supabase, and a safe Report-Only rollout.
- [Is your .env, .git, or source code public?](https://vibelocked.com/guides/exposed-env-git-source-maps-deployed-app/): How vibe-coded apps end up serving .env files, .git folders, and source maps, a five-minute check for your site, and fixes for Vercel, Netlify, and Cloudflare.
- [Fix IDOR (BOLA) in Next.js and Supabase](https://vibelocked.com/guides/idor-broken-object-level-authorization-nextjs-supabase/): Fix IDOR in Next.js Route Handlers and Supabase: get the user from a verified session, scope every query by owner, add RLS, and test with a second account.
- [Fix open redirects in Auth.js, Supabase, and Clerk](https://vibelocked.com/guides/open-redirect-callbackurl-authjs-supabase-clerk/): AI-built login flows often redirect to any callbackUrl, redirectTo, or next value in the URL, sending users to phishing sites. How to allow-list redirects.
- [Prompt injection defense for vibe-coded AI apps](https://vibelocked.com/guides/prompt-injection-ai-features-vibe-coded-apps/): If your app sends user text, files, or web pages to an LLM, someone can hijack it. How prompt injection hits chatbots, RAG, and agents, and how to limit it.
- [Rate limit AI API routes: Next.js and Supabase](https://vibelocked.com/guides/rate-limit-ai-api-routes-nextjs-supabase/): Rate limiting for OpenAI and other LLM routes: per-user and per-IP limits with Upstash, daily token budgets, Supabase Edge Functions, and provider spend caps.
- [Secure file uploads in Next.js and Supabase](https://vibelocked.com/guides/secure-file-uploads-nextjs-supabase-vercel-blob/): Stop uploads that trust file.type, skip auth, or land in public/. Use direct-to-storage uploads, MIME allow-lists, safe filenames, and private storage buckets.
- [Secure Vercel Cron jobs with CRON_SECRET](https://vibelocked.com/guides/vercel-cron-jobs-cron-secret/): AI-generated apps often leave /api/cron routes open. How Vercel sends CRON_SECRET as a Bearer token, how to return 401 to other callers, and fail-open bugs.
- [XSS in React and Next.js: dangerouslySetInnerHTML](https://vibelocked.com/guides/xss-dangerouslysetinnerhtml-markdown-ai-output-react-nextjs/): React escapes JSX text, but dangerouslySetInnerHTML, rehype-raw, and AI chat output can still run attacker scripts. Sanitize with DOMPurify and allow-list URLs.
- [Clerk publishable key vs secret key](https://vibelocked.com/guides/clerk-publishable-key-vs-secret-key/): Your Clerk pk_ key is fine in frontend code; your sk_ key and whsec_ secret are not. The right env var names for Next.js and Vite, and how to rotate a leak.
- [Is it safe to expose your Firebase API key?](https://vibelocked.com/guides/firebase-api-key-public-app-check/): Why the Firebase web API key is public by design, the one restriction that makes it dangerous, and how Security Rules and App Check actually protect your data.
- [Next.js middleware auth bypass CVE-2025-29927](https://vibelocked.com/guides/nextjs-middleware-auth-bypass-cve-2025-29927/): CVE-2025-29927 let one header skip Next.js middleware auth checks. Affected versions, the patched releases, who is safe, and how to fix your app.
- [Remove a leaked API key from GitHub history](https://vibelocked.com/guides/remove-api-key-from-github-history/): Rotate the key first, then purge it from every commit with git filter-repo or BFG, force-push carefully, and clean up clones, forks, and GitHub's cached views.
- [Stripe paywall bypass on the success page](https://vibelocked.com/guides/stripe-success-page-paywall-bypass/): If your app grants paid access when someone lands on ?success=true, anyone can type that URL. Unlock features only from verified Stripe data, using webhooks.
- [Supabase Auth security settings before launch](https://vibelocked.com/guides/supabase-auth-security-settings/): Supabase Auth settings AI-built apps leave on defaults: Site URL, redirects, email confirmation, password rules, leaked password checks, and reauthentication.
- [Secure Vercel preview deployments and env vars](https://vibelocked.com/guides/vercel-preview-deployments-env-vars/): Preview URLs can expose unfinished features and production data. Set Deployment Protection, split Preview and Production env vars, and use Secret variables.
- [How to check if your API key leaked on GitHub](https://vibelocked.com/guides/check-if-api-key-leaked-on-github/): Search your repo, your git history, and GitHub's own alerts for exposed API keys, then know what to do when you find one, starting with rotation.
- [Env variables in Cursor, Bolt.new, and Lovable](https://vibelocked.com/guides/environment-variables-cursor-bolt-lovable/): Which env vars end up in the browser, how to keep .env files away from AI agents and git, and where server secrets belong in Cursor, Bolt.new, and Lovable.
- [Next.js Server Actions security](https://vibelocked.com/guides/nextjs-server-actions-security/): Server Actions are public HTTP endpoints. How to add authentication, authorization, and input validation so AI generated actions are safe to ship.
- [Stop strangers from running up your OpenAI bill](https://vibelocked.com/guides/protect-openai-api-route-from-abuse/): Your AI API route is a free proxy to your OpenAI or Anthropic account until you lock it down. Auth, rate limits, input caps, and spend limits.
- [Replit Secrets guide](https://vibelocked.com/guides/replit-secrets-guide/): How to store API keys in Replit Secrets, read them safely in code, and avoid leaking them through public Repls, frontends, and logs.
- [A security review prompt for AI coding tools](https://vibelocked.com/guides/security-review-prompt-for-ai-coding-tools/): A copy-paste prompt that asks an AI coding tool for a security review, plus how to read the answer without trusting it blindly.
- [Supabase anon key vs service role key](https://vibelocked.com/guides/supabase-anon-key-vs-service-role-key/): Which Supabase key is safe in the browser, which one bypasses Row Level Security, and where each belongs in a Lovable, Bolt, or Next.js app.
- [Supabase Storage security: buckets and RLS](https://vibelocked.com/guides/supabase-storage-bucket-security/): Stop strangers from listing, downloading, or overwriting files in Supabase Storage, with policies for per-user folders and signed URLs.
- [Common vulnerabilities in vibe-coded apps](https://vibelocked.com/guides/common-vibe-coded-app-vulnerabilities/): How IDOR, exposed service role keys, and missing auth on API routes show up in apps built with AI coding tools, and how to fix each one.
- [Securing Stripe webhooks](https://vibelocked.com/guides/securing-stripe-webhooks/): Verify the Stripe-Signature header on the raw body, keep the webhook secret on the server, and ignore duplicate events before you grant access.
- [Keep secrets out of frontend code](https://vibelocked.com/guides/keep-secrets-out-of-frontend-code/): What Next.js and Vite put in the browser bundle, which keys are safe there, and where Supabase, Firebase, and Stripe secret keys actually belong.
- [The first hour after an API key leaks](https://vibelocked.com/guides/first-hour-after-an-api-key-leaks/): Revoke the leaked API key first. Then check logs for use, replace it with less privilege, and clean up git only after the old key is dead.

## Site
- [Home](https://vibelocked.com/): The promise, latest checklists and guides, the free repo scanner, and newsletter signup.
- [Checklists index](https://vibelocked.com/checklists/): All launch checklists.
- [Secret leak scanner](https://vibelocked.com/scan/): Free client-side scanner. Scans a public GitHub repo in the browser to detect OpenAI, Stripe, Supabase service role, AWS, GitHub and other keys. Nothing leaves the browser.
- [Exposed by default study](https://vibelocked.com/study/): Aggregate data from anonymous, read-only checks of 2,511 live vibe-coded apps across nine platforms. 4.8% exposed an open database table; 19.9% of Supabase apps did. 8.2% shipped production source maps.
- [Guides index](https://vibelocked.com/guides/): All launch guides.
- [Sponsor](https://vibelocked.com/sponsor/): Media kit. Contact sponsors@vibelocked.com. No invented traffic numbers.
- [About](https://vibelocked.com/about/): Independence, funding, and corrections.
- [Newsletter](https://vibelocked.com/newsletter/): A security note every week, sent with Buttondown. Double opt-in, one-click unsubscribe.
- [Privacy](https://vibelocked.com/privacy/): No cookies. Cookieless page counts with GoatCounter. The scanner sends nothing to VibeLocked.
- [RSS](https://vibelocked.com/rss.xml): Article feed.

## Optional
- [llms.txt specification](https://llmstxt.org/): Format used by this file.