The vibe coding security checklist: 12 checks before you ship

Vibe coding is wonderful for getting from idea to working app in an afternoon. It is less wonderful at reminding you about the boring security work that stands between a demo and something real users can trust.

Roughly 84% of developers now use AI coding tools, yet close to 46% say they do not trust the output. Independent research keeps finding that around 45% of AI-generated code ships with a known security weakness. Most of that risk is preventable with a short, concrete checklist. Here is the one we use.

The 12 checks

1. Enforce HTTPS everywhere. Redirect all HTTP to HTTPS, use modern TLS, and add security headers like HSTS, X-Content-Type-Options, and a content security policy.
2. Keep secrets out of the code. API keys, database URLs, and tokens belong in environment configuration, never committed to the repo and never shipped in the client bundle.
3. Lock down authentication. Sessions should expire, passwords should be hashed with a strong algorithm, and login should resist guessing with rate limits.
4. Check access control on every request. The most common AI-built bug is a user being able to read or change another user's data by changing an id. Verify ownership server-side, every time.
5. Validate and sanitize input. Never trust what comes from the client. Guard against injection in queries, and escape anything you render.
6. Scan your dependencies. Run an audit for known-vulnerable packages and update them. AI often pulls in outdated libraries.
7. Handle errors safely. Catch, log, and return a clean message. Never send stack traces or internal details to the user.
8. Set rate limits on sensitive endpoints. Login, signup, password reset, and any expensive operation should not be callable a thousand times a second.
9. Protect against CSRF and clickjacking. Use anti-CSRF tokens on state-changing requests and frame-ancestor protection.
10. Review what you log. Logs should never contain passwords, tokens, or full personal records.
11. Back up your data, and test the restore. A backup you have never restored is a guess, not a safety net.
12. Add a health check and a rollback path. Know when something breaks, and be able to step back to the last good release in seconds.

The two that catch people most

If you only fix two things today, fix access control and secrets. Broken access control, where a user can reach data that is not theirs by changing an id in the URL, is the single most common serious flaw in AI-built apps. And a secret committed to a public repo is scraped by bots within minutes, so a leaked key is a leaked key the moment it lands.

Turn the checklist into evidence

A checklist you tick by hand is a good start and a weak proof. When you need to show a buyer, an investor, or your own team that these are actually handled, you want evidence, not a ticked box.

StackAttest checks most of this list automatically against your live app or repository and produces a Passport, so the checklist becomes something you can hand to someone else with confidence.