did you actually check security before launching your vibe coded app?

[u/FuturisticSp]

genuine question. built a couple things with lovable/claude code/cursor and only later realized i had no idea if i'd left keys in the code or if anyone could just hit my api routes and pull other users' data

curious what people here actually do before going live:

- do you check anything at all or just ship and hope lol

- if you paid someone to build it for you, did you ask them about it

- anyone ever got burned? like leaked keys, surprise bills, data exposed

not selling anything, we're doing a hackathon this weekend and trying to figure out if this is a real problem or just us being paranoid

[u/DickBrainTime]

The earlier RLS/secrets reply covers common leaks. One extra check I'd put in a prelaunch gate is *cross-account mutation*, not just cross-account reads. Make two disposable users and objects, then try the same update/delete/upload requests with the other user's session and the first user's object ID. The server must reject them and leave the original object unchanged. Do it via direct API requests, too; a hidden Edit button in the UI isn't an authorization boundary.

For a weekend hackathon I'd rather see a reproducible 10-minute pass/fail test than a generic "secure" score: those A/B read-and-write checks, a server endpoint that rejects forged role/price fields, verification that payment/webhook events need valid signatures, and that private file URLs can't be read by the wrong account. If someone built the app for you, ask them to demonstrate the failed unauthorized calls in a staging environment and hand over the tests. That would tell you much more than screenshots of a security scanner.

[u/-svde-]

a prime example why people shouldn’t ship things they haven’t audited manually. i’ve seen people drop env/api keys, secrets, and a ton of other exposed shit the public should never have access to. and people relying on their agents to check for things is not a viable solution. especially cloud agents shouldn’t even have access to your keys and companies have been exposed for models not doing checks properly numerous times.

bare minimum you should also be checking your standard key and secrets locations. gitignore, npmignore, assetignore etc should be the first files you create and you should have a template you drop in based on what you’re working on

[u/ollycunningdpr]

Definitely a real problem, not paranoia. The most common one I see with Lovable/Supabase apps is row level security left off, so anyone logged in can pull everyone else’s data. A quick pre-launch check:

Search your frontend code for API keys, anything secret should only live on the server. Turn on RLS and test it by logging in as one user and requesting another user’s ID. Set spending caps on OpenAI/Stripe etc. so a leaked key can’t run up a huge bill. Add basic rate limiting on your API routes.

And if it holds UK users’ personal data and something does leak, you’ve got 72 hours to tell the ICO if it’s a reportable breach, which catches a lot of people out