Is my vibe-coded app safe to launch?
Not until someone has read the code, because an app built with Lovable, Bolt, Cursor or Replit can work perfectly and still leave the door open. The usual gaps are keys and secrets exposed in the browser, pages and API routes that skip the sign-in check, and database rules, such as Supabase Row Level Security, that let any visitor read or change data.
Evidence
I build software with AI coding agents every day, and what they write is only as safe as the process that checks it. In WASBuilder, every change an agent makes is tested, reviewed against its specification and approved by a person before it ships.
- 665 of 681 WASBuilder tickets shipped, each through tests, review and human approval
- 17.4% of WASBuilder tickets needed rework before they shipped, caught by review rather than by customers
- 149 API routes in TaskTree, each counted by a test so none goes in untested
Exposed keys and secrets. AI tools put whatever makes the app work where it works fastest, and that is often in the code sent to every visitor's browser, or in the repository's history after the line that held it was deleted. A key in the browser is a key anyone can use.
Authentication. A sign-in screen does not mean every page and API route checks who is asking. The tool builds the screen the prompt described; it does not always guard the routes behind it, so a visitor who knows the address can skip the screen altogether.
Database access rules. Supabase Row Level Security being turned on only means the rules are checked. The rules themselves can still let any signed-in user read every row, or let anyone write to a table, and nothing in a working demo shows it.
A demo that works proves the happy path. It says nothing about the paths a curious or hostile visitor will try, and those are the ones a review reads for.
What it takes
Read access to the repository, whichever tool produced it, and to the database settings, such as the Supabase policies.
Five business days. The report ranks every finding by how much harm it can do and how much it costs to fix, so you know what must change before launch and what can wait.
The honest limits: the audit covers security and code only. It reads the code and the database rules, and it is not a formal penetration test or a compliance certification. It finds the problems; you or your developer fix them.
Next step
Before real customers and real data arrive, have the code read. The Vibe Code Audit is a fixed-price security and code review for apps built with Lovable, Bolt, Cursor and Replit.