Independent security hub
Ship your AI-built app without leaking data or keys.
VibeLocked is a plain-language field manual for people building with Lovable, Bolt, v0, Cursor, Replit, Supabase, Firebase, and Next.js.
The guides are free to read. Sponsors, a featured tool slot, labeled affiliate links, and a weekly newsletter are how the site stays up. Launch articles are not paid placements.
Checklists
Run these before launch
- 01ChecklistShip checklist for a vibe-coded appThe ordered checks to run before you share the URL of an app built with Lovable, Bolt, Cursor, Supabase, or Firebase.
- 02ChecklistLovable and Bolt pre-launch security checklistA pre-launch pass for Lovable, Bolt, v0, Cursor, and Replit apps: keys, rules, auth, storage, and payments.
- 03ChecklistFirebase security rules checklistReplace test mode, stop open rules, and check ownership, queries, and custom claims before you ship Firestore.
- 04ChecklistSupabase RLS security checklistEnable RLS, fix grants, write one policy per operation, and test as anon before you ship a Supabase app.
Guides
Read these when something looks off
- 01GuideHow to check if your API key leaked on GitHubSearch your repo, your git history, and GitHub's own alerts for exposed keys, then know what to do when you find one.
- 02GuideNext.js Server Actions securityServer Actions are public HTTP endpoints. How to add authentication, authorization, and input validation so AI generated actions are safe to ship.
- 03GuideReplit Secrets guideHow to store API keys in Replit Secrets, read them safely in code, and avoid leaking them through public Repls, frontends, and logs.
- 04GuideA security review prompt for AI coding toolsA copy-paste prompt that asks an AI coding tool for a security review, plus how to read the answer without trusting it blindly.
- 05GuideSupabase anon key vs service role keyWhich Supabase key is safe in the browser, which one bypasses Row Level Security, and where each belongs in a Lovable, Bolt, or Next.js app.
- 06GuideCommon vulnerabilities in vibe-coded appsHow IDOR, exposed service role keys, and missing auth on API routes show up in apps built with AI coding tools.
- 07GuideSecuring Stripe webhooksVerify the Stripe-Signature header on the raw body, keep the webhook secret on the server, and ignore duplicate events.
- 08GuideKeep secrets out of frontend codeWhat Next.js and Vite put in the browser bundle, and where Supabase, Firebase, and Stripe keys actually belong.
- 09GuideThe first hour after an API key leaksRevoke the key first. Then check logs, replace it with less privilege, and clean up git only after the old key is dead.
Weekly note
One useful security note a week
Leaks, rules, and launch checks. No invented incident counts.