A vibe coding security checklist

Apps built by prompting an AI ship fast and break in the same places, which is useful, because a failure that repeats can be checked for. This vibe coding security checklist comes from those places rather than from a generic list of web vulnerabilities, and it is short on purpose: four things that go wrong often enough that checking them before launch is cheaper than finding out after.

The first is exposed keys: a secret pasted into client code to get something working ends up in the bundle every visitor downloads. The second is row-level security left off, which on Supabase leaves a table readable with the public key that sits, by design, in the browser. The third is API routes with no authentication check, reachable by anyone who reads the network tab. The fourth is paid model calls with no rate limit, where a loop or a hostile user can run up a bill before anyone notices.

The reason these repeat is that the person shipping often cannot audit what was generated, and nobody else is looking before it goes live. A model will produce a working edge function without deciding who is allowed to call it, because nobody asked. The code is incomplete in exactly the places a reviewer would have caught.

Rhomn Scan turns the checklist into rules that run against a codebase from the command line. Its engine reads every file and is structurally forbidden from installing or executing anything it scans, which matters when the code being checked is the code nobody trusts yet. A free report gives a score and severity counts, and the full report carries fix prompts that can be pasted straight back into the tool that wrote the code.

The first rule to reach production finds unauthenticated Supabase edge functions, and its own first draft missed ten of twelve because it trusted a setting as a security boundary. That rewrite is written up in verify_jwt is not authentication, and the scanner itself is in the Rhomn Scan case study.