Guide
How to secure your vibe-coded site
To secure a vibe-coded site, lock down the five things the AI skipped: database access rules, secret keys that leaked into the browser, a public .env or source maps, missing security headers, and any key that was ever exposed. Each is checkable from your live URL in about a minute, and together they cover what vibe coding leaves open.
Why vibe-coded sites ship insecure
Vibe coding gets you a working app fast, and speed is the whole appeal. The catch is that a working app and a secure app are different things. The AI wires up your database and your keys to make features work, and it leaves the locking-down to you, usually without saying so. So the holes are invisible from the front end and wide open from the back.
A working app and a secure app are different things.
The five checks that secure it
- Turn on database access rules. Row-level security for Supabase, security rules for Firebase, scoped so each user only sees their own rows.
- Get secret keys out of the browser. Only publishable keys belong in client code. Service-role, secret payment, and cloud keys stay on the server.
- Kill public .env and source maps. Neither should be reachable from your domain.
- Set security headers. Frame protection, content-type protection, and a sensible cross-origin policy.
- Rotate anything that leaked. A secret that was ever public is already collected, so replace it.
Check it from the outside in a minute
You do not need to read your own code. Every one of those five is visible in what the browser already downloads. Paste your live URL into Plaintext and it reports them worst first, in plain language, with the exact fix for each. The first scan is free.
Frequently asked
Are vibe-coded sites safe?
A vibe-coded site can be safe, but it is not safe by default. The AI leaves database rules and key handling to you, so a working site often still has an open database or exposed keys until someone checks and fixes it.
How do I secure a site I built with AI?
Turn on database access rules, move secret keys to the server, make sure no .env or source maps are public, set security headers, and rotate any leaked secret. Each is testable from your live URL, so scan it to confirm.
Can a vibe-coded site get hacked?
Yes, most often through an open database or a secret key left in the browser. Both let a stranger read or change your data without breaking in. Both are visible from your public URL, and both are fixable once you find them.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes vibe coding tools leave open. The first scan is free.
Scan my app