Resources
Can you trust what you built?
Plain-language answers to the questions people actually ask about putting AI-built software in front of real customers — plus a free audit checklist. Written by a security engineer, not a hype account.
Is your AI-built app safe to put in front of customers?
A plain-English triage for non-technical founders. Green, yellow, and red signals to check before you share a vibe-coded app with real customers — tool by tool.
The pre-launch security checklist for Lovable, Replit, Bolt, and Base44
A cross-platform security checklist before you share a vibe-coded app. Covers secrets, auth, database rules, and per-tool specifics for Lovable, Replit, Bolt, Base44, and v0.
How to tell if your Supabase database is exposed (without being a developer)
Check whether your Supabase database is exposed. A plain-English walkthrough of RLS, anon vs service-role keys, and table permissions for non-technical vibe-coded app builders.
Production-ready vs demo-good: the vibe-coding reality check
What production-ready actually means for a vibe-coded app. Split by risk class: prototype, internal tool, paid beta, and regulated — with a plain-English bar for each.
Which vibe-coding tool should you use? Choose by risk, not hype
Lovable, Replit, Bolt, v0, Base44, Cursor, Claude Code mapped to use case and risk class. Prototype vs paid-beta vs regulated — with security model and export path for each.
Did the AI put your API keys in the wrong place? How to check and what to rotate
How to spot API keys in the wrong place in a vibe-coded app, and what to rotate immediately. Covers OpenAI, Stripe, Supabase, and Twilio. Publishable vs secret keys explained.
Can someone see another user's data in your AI-built app?
Can one user in your AI-built app see another's records? Object-level authorization explained in plain English — with the two-account test any founder can run.
You already shipped and now you're worried: a 60-minute containment plan
A step-by-step 60-minute containment plan for founders who shipped a vibe-coded app and now have concerns. Take private, rotate keys, check logs, and prioritize what to fix.
What should you ask an expert to audit in your AI-built app?
Turn security anxiety into a concrete audit scope. Six areas an expert reviews in a vibe-coded app: secrets, auth, data isolation, payments, logging, and dependencies.
Can you add Stripe safely to a vibe-coded app?
Stripe in a vibe-coded app: server-side checkout, secret key placement, webhook validation, test mode, and fraud controls — a plain-English guide to getting each one right.