Vibe Coding Security Checklist: Interactive, Printable

Tick each check as you finish it. Progress is saved in your browser on this device only, nothing is sent anywhere. Each item links to the guide that shows how.

Step 1: Secrets and keys

No secrets in code, prompts or screenshots How
.env is in .gitignore and was never committed How
Only publishable keys reach the browser How
Secret scanning or push protection is on, leaked keys were rotated How
Spending limits and alerts are set on every paid API How

Step 2: Access control

Two-user test passed: user B cannot open user A's data How
Row-level security or database rules are on for every table How
Admin routes are checked on the server, not just hidden How
Two-factor authentication on admin, hosting and Git accounts How
Login and password reset are rate limited How

Step 3: Code and dependencies

Code that touches money, login, files and the database was read How
Database queries are parameterised How
Every dependency was verified and the lockfile is committed How
Debug mode is off in production How

Step 4: Server lockdown

SSH keys only, no root login How
Firewall is default-deny with SSH, 80 and 443 allowed How
Automatic security updates are on How
The app runs as a normal user, not root How
fail2ban or an equivalent is running How

Step 5: Public exposure

Only ports 22, 80 and 443 are public (checked with ss -tlnp) How
Databases and caches listen on localhost How
HTTPS and security headers are on How
Docker ports bound to 127.0.0.1, no docker.sock mounted How
.env and .git cannot be downloaded from the domain How

Step 6: Abuse and cost

Expensive routes have rate limits How
Paid APIs are called only from the server with per-user quotas How
A CDN or proxy sits in front of the site How

Step 7: AI agents

Development and production are separate; the agent has development credentials only How
The agent has the smallest rights that work, no root How
Destructive actions need approval and work happens on a branch How
A security rules file is in the project How

Step 8: Backups

3-2-1 backups are running and the database is dumped on a schedule How
One copy cannot be changed or deleted from the server How
A restore was tested this month How

Frequently asked questions

How do I use this checklist?

Work through the steps in order and tick each item when it is done. Every item links to a guide with the exact commands. The list is saved in your browser, so you can come back later.

Is my progress sent anywhere?

No. Progress is stored in your browser on this device only (local storage). Clearing site data or using another browser starts a fresh list.

How often should I run the checklist?

Run it in full before launch and again every month, and repeat the relevant steps after big changes such as a new database, a new provider or letting an AI agent work on production.

Pre-launch security checklist for vibe-coded apps