Before you ship an AI / vibe-coded app

Minutes 0–5 — Secrets

1. Search the repo and built JS for service_role, sb_secret_, OpenAI/Anthropic keys, Stripe secret keys.
2. Anything privileged stays on a server / edge function — never in the browser bundle.
3. Rotate anything that ever touched a commit or a public preview URL.
4. Make sure .env files and the .git folder are never in your deploy output, and that your host does not serve dotfiles.
5. Publishable keys (Stripe pk_, Supabase anon / sb_publishable_, the Firebase web apiKey) are meant to be public. Secret and restricted keys (Stripe sk_ / rk_) are not.

Minutes 5–10 — Supabase / Firebase data

1. Enable RLS on every table (see the RLS checklist).
2. Confirm anon cannot select * user PII.
3. Mark storage private unless the asset is intentionally public.
4. On Firebase: no allow read, write: if true in Firestore or Storage rules, no ".read": true at the Realtime Database root, and App Check on.
5. Run a free RLS Radar scan on your production URL (only if you own it).

Minutes 10–15 — Auth & product hygiene

1. Test sign-up / sign-in / sign-out on a fresh profile.
2. Block open redirects and verify email templates do not leak tokens in referrers.
3. Turn off verbose debug logging in production, and decide on purpose whether production source maps should be public.
4. Add basic security headers: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options (or CSP frame-ancestors), X-Content-Type-Options: nosniff.
5. Add a privacy note if you collect emails or trading / game / health-adjacent data.

Ship gate

You are ready to share the link when: no secret keys in the frontend, RLS on, storage intentional, and a passive scan shows no critical findings.

Run RLS Radar →