← Guides

The vibe coding security checklist (before and after every deploy)

1. No secret keys in frontend code or browser-exposed env vars.
2. RLS on for every Supabase table, with owner-only policies by default.
3. Views use security_invoker = true.
4. No .env or .git in the published output.
5. Production source maps off (or uploaded privately).
6. HTTPS everywhere, HTTP redirects to HTTPS.
7. CSP, HSTS, X-Frame-Options, nosniff, Referrer-Policy set.
8. Re-check after every deploy: AI edits can silently undo any of the above.

LatchDog automates the outside-in parts of this list weekly, and on every deploy with Pro.