Vibe Coding Security Checklist: 10 Questions to Ask Before You Launch

I'm not a developer. I build apps with AI tools, and for a long time my plan for security was to hope the AI had handled it. What I wanted was a short list of plain questions I could actually ask, and a way to check the answers without reading code.

So I wrote one. It's ten questions, and it's the list I now run through before real users or payments arrive.

The ten questions

1. Is the login checked on the server, including for admin pages, and not just hidden in the buttons?
2. Can one user see another user’s data? Test with two accounts.
3. Is access control on for every database table with user data?
4. Any keys or passwords in the code or its history? Are secrets kept on the server only?
5. Does the app treat typed text as data, not code?
6. Are uploads limited by type and size?
7. Does CORS allow only your own site?
8. Are there limits on login attempts and costly actions?
9. Do payment and webhook endpoints check who is calling?
10. Are packages updated, with the lock file saved?

For each one, the full checklist gives a plain reason it matters, a way to check it yourself or a question to put to your AI builder, and an honest note on whether Verilay covers it.

Why questions, not a scan result

A scan result is a lead, not a verdict. It can tell you something looks wrong, but it can't know your app the way your AI builder does, and it can't see settings that live in a dashboard. A question you can test yourself is harder to misunderstand. Open a private window and try to reach a page that should need a login. Make two test accounts and see whether one can see the other's data. Type a single apostrophe into a search box. Each takes a couple of minutes, and none of them needs you to read code.

What Verilay covers, and what it doesn't

Verilay covers parts of this list: fixed checks for keys in your code, known-vulnerable packages and, for Supabase apps, access rules, plus an AI review of the code it reads. The AI review can vary and can miss things, and the free scan reads the most important files rather than all of them. Everything else you test yourself, or ask a person to look at.

Of the ten, fixed checks cover items 1, 2, 3, 4 and 10 in part or in full. The AI review looks at most of the rest, and it can miss things. Backups and rolling back live outside the code, so a scan can't see them at all. That's why the checklist says plainly which is which.

If you're not sure your app will earn anything

If you’re not sure yet that your app will earn anything, the free version is a good place to start: fix what it finds with your AI builder first, and think about a deeper review once you have users or payments to protect.

For anything serious, such as real money or sensitive data, have an experienced person look as well.

Try it

The checklist is free to read, with no sign-up. If you'd like a first look at your own app, paste a public GitHub link or upload a ZIP at verilay.dev. It usually takes one to three minutes. If anything on the list is unclear, or you think something is missing, tell me and I'll improve it.

General good practice. Not a standard, and not a guarantee.