What should be on a vibe coding security checklist?

Enforce HTTPS and security headers, keep secrets out of code, lock down authentication, check access control on every request, validate input, scan dependencies, handle errors safely, rate-limit sensitive endpoints, protect against CSRF and clickjacking, review your logs, test your backups, and add a health check and rollback path.

Is this checklist free to use?

Yes. The interactive checklist is free, runs in your browser, and requires no signup.

Free tool

The vibe coding security checklist

Twelve concrete checks that stand between a demo and something real users can trust. Tick what you have done and watch what is left. It runs in your browser, and nothing is sent anywhere. When you need proof, StackAttest maps collected evidence to controls aligned with OWASP ASVS 5, NIST SSDF, CWE, OWASP API Security Top 10, WSTG, SLSA.

0 of 12 done

1. Enforce HTTPS everywhere

Redirect all HTTP to HTTPS, use modern TLS, and add HSTS, X-Content-Type-Options, and a content security policy.

2. Keep secrets out of the code

API keys, database URLs, and tokens belong in environment configuration, never committed and never in the client bundle.

3. Lock down authentication

Expire sessions, hash passwords with a strong algorithm, and rate-limit login against guessing.

4. Check access control on every request

Verify server-side that the user owns what they are asking for. Changing an id should never reveal someone else's data.

5. Validate and sanitize input

Never trust the client. Guard against injection in queries, and escape anything you render.

6. Scan your dependencies

Audit for known-vulnerable packages and update them. AI often pulls in outdated libraries.

7. Handle errors safely

Catch, log, and return a clean message. Never send stack traces or internal details to the user.

8. Rate-limit sensitive endpoints

9. Protect against CSRF and clickjacking

Use anti-CSRF tokens on state-changing requests and frame-ancestor protection.

10. Review what you log

Logs should never contain passwords, tokens, or full personal records.

11. Back up data and test the restore

A backup you have never restored is a guess, not a safety net.

12. Add a health check and a rollback path

Know when something breaks, and be able to step back to the last good release in seconds.

A ticked checklist is a good start and a weak proof. When you need to show a buyer or investor that these are actually handled, StackAttest checks most of this list automatically against your live app or repository and turns it into a Passport you can share.

Validate my app Read the full guide