Scan the repo and its history
How to check: Run gitleaks or trufflehog on the working tree and on the full git history, and treat every hit as live until you prove it is a fixture.
Checklist · before the first users
Vibe-coded app pre-launch checklist.
Checks to run before an app an agent wrote takes users. Do the check. Write down what you saw.
01Secrets
Scan the shipped client bundle
How to check: Build the production bundle and grep the built JavaScript for sk_, rk_, AKIA, service_role, and BEGIN PRIVATE KEY. The only Stripe key that belongs in that bundle is a publishable key (pk_).
If the host already leaked secrets
How to check: Your host had a secrets breach. Treat every key that lived on that host as exposed and rotate it. The rotation steps, spend caps, billing alerts, and revoke list are at https://josephdecker.app/breach-response/.
02Authorization
Swap user A and user B
How to check: Sign in as user A, copy a request for A's row, replace the id with user B's id, and send it. The server must answer 403 or 404.
Turn on row-level security
How to check: Where the database supports it (Postgres, including Supabase), enable row-level security on every customer table and confirm request handlers do not connect with the service-role key.
03Auth and sessions
Rate-limit login and password reset
How to check: Send a short burst of failed logins and password-reset requests for one account from one IP. Confirm the server returns 429, or the rate-limit response you configured, and write down the limit.
Set the session cookie flags
How to check: In the browser, confirm the session cookie is HttpOnly, Secure, and SameSite=Lax or Strict. A token in localStorage is not this cookie.
Logout kills the server session
How to check: Copy the session cookie, log out, and replay an authenticated request with the copied cookie. The server must reject it.
Run an OWASP ZAP baseline scan
How to check: Run the OWASP ZAP baseline scan (zap-baseline.py, or the zaproxy/zap-stable image) against a staging URL that includes login, and read the alerts.
04Spend caps and alerts
Cap and alert every vendor key
How to check: On each API key and vendor account you pay (model provider, email, SMS, host, database), set a spend cap and an alert that a person reads.
Keep a written key list
How to check: Write down every production key, the account that holds it, and the revoke step. The list names keys. It does not store key values.
Set the cap on the key you just rotated
How to check: After a secrets breach, a new key with no spend cap is the same open meter. The provider cap and billing-alert pages are listed at https://josephdecker.app/breach-response/.
05Dependencies and headers
Audit dependencies
How to check: Run npm audit, and pip-audit or OSV-Scanner, against the lockfile you ship, and triage high and critical findings before launch.
Set CSP, HSTS, and frame protection
How to check: Send Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options or CSP frame-ancestors, then confirm those headers on Mozilla Observatory.
06Independent review
One pass that did not write the code
How to check: Have a person, or a separate review that was not given the same prompt and the same assumptions, read auth, tenancy, and the secret scan. AI-written tests tend to agree with AI-written code.
07Also check
Agent permissions and prompt injection
How to check: List every tool and credential an agent in the product, and an agent in the dev loop, can call. Paste a user message, a fetched page, and a support ticket into that path and confirm none of them can spend, send mail, or read another tenant.
Key custody
How to check: Write who holds production keys, where they are stored, how they are rotated, and which keys you revoke the day someone leaves.
Trial and signup abuse
How to check: Open a second account with a disposable-email domain and a second card on the free tier. Signup must be rate-limited, and the repeated card or disposable domain must be rejected or flagged.
Vendor and processor exit
How to check: Write the fallback if the registrar, the payment processor, or the email provider suspends the account, and confirm you can export the domain, the DNS records, and the customer list today.
Single-region outage
How to check: Name the region the app, the database, and the object store run in, and write what a zone outage does to signup and to existing users. Google Cloud's status page records a London (europe-west2) incident from 2026-10-19 23:08 to 2026-10-20 07:00 US/Pacific: a power event made services unavailable in europe-west2-b, and some europe-west2 services returned elevated errors (https://status.cloud.google.com/incidents/Xs2XTHzAVC9YnafnPyzj).
Tenant vetting
How to check: Write who you allow onto a multi-tenant product and what one tenant can do to the others, including invite, export, webhook URL, and custom domain.
Signed commits
How to check: On GitHub, enable Require signed commits on the default branch, then push an unsigned commit and confirm it is rejected.
If you want this done for you, the Launch Hardening / Stack Audit is $750, async, 5 business days, at https://josephdecker.app/audit/.