Vibe coding security audit

What a security audit of a vibe-coded app should cover, what it costs to have one done, and how to do the first pass yourself.

"Vibe coding" means describing the app and letting the model write it, without reading most of the code. It is a fine way to get to a working product. It is a bad way to get to a secure one, because the model writes what was asked, and security is the part nobody asks for. The failures are not clever. They are the same five things, in nearly every app, in nearly the same places.

The five things

1. Anyone can read anyone's data. A database with row-level security off, a route that takes an id and does not check who is asking, a Firestore rule that says if true. This is the finding that gets a startup on the front page of a forum.
2. A secret is in the browser or in git. An API key behind a VITE_ or NEXT_PUBLIC_ prefix, a service-role key in a component, a .env in an old commit. Costs you the key, and whatever the key could do.
3. The customer sets the price. Checkout built from an amount in the request, a webhook that grants a plan without checking a signature, a "premium" flag the client can write.
4. The AI endpoint is a free API. No login, no quota, and often tools attached that the model can call on behalf of whoever is typing.
5. Nothing is rate limited. Signup, login, password reset, and the expensive endpoints, all unthrottled. Credential stuffing and bill inflation follow.

The first pass you can do yourself, in an hour

• Search the repository for sk_live_, service_role, -----BEGIN, whsec_, and every client-prefixed variable name. Then run git log -p | grep for the same strings.
• List every table (or collection) and its access rules. Any rule that amounts to "everyone" on user data is a finding.
• List every route, function, and server action. Mark which ones check the caller. The unmarked ones are your to-do list.
• Open the payment code and find where the amount comes from and where the webhook signature is verified.
• Run your package manager's audit.

Our free seven-area checklist is the longer version of this list. The automated part (secret patterns, client-exposed variables, committed env files, handlers without auth-looking code, audit output) is what the vibe-check command-line tool does locally; it is being prepared for release and will be linked here.

What a real audit adds

Automated tools produce candidates, not findings. A candidate is "this route has no auth import"; a finding is "this route returns any user's invoices given an id, here is the line, here is the fix". Turning one into the other means reading the code. That is the paid part of Repo Review: every candidate and every checklist area is read and judged reachable or not, and what is not real is dropped with the reason kept in the appendix.

What it costs, and what it is not

A Repo Review is $79 for an app up to about 15,000 lines of your own code and $149 up to about 60,000, with a $29 re-check within 30 days to confirm fixes. It is a static review of the repository as submitted. It is not a penetration test, not a bug bounty, and not a certification of any kind. If you need a SOC 2 report or a PCI attestation, you need an auditor; a review like this is what you do before that so the auditor finds less.

When you want it done for you

Repo Review is a static review of your repository: every item above and the full seven-area checklist, read in your code and judged reachable or not, with the file and line and a fix snippet for each finding. HTML and PDF report within 48 hours, from $79. See the sample report first.

Order a review, from $79 How it works