Security Checklist Before You Launch an AI-Built App

A 7-part checklist for vibe-coded apps: access control, secrets, user input, auth, dependencies, personal data and recovery, based on OWASP and Veracode.

It is the night before launching the app you built with AI. Everything looks ready: the design is clean, forms submit, data lands in the database. But the question to ask before sharing the link is: "If someone deliberately tried to break in, what would this app expose?" An app that works is not necessarily safe, and AI tends to focus on making features work rather than defending against people who misuse them.

Why AI-built apps need their own checklist

Veracode published research in July 2025 that tested more than 100 language models on 80 coding tasks and found security weaknesses in AI-generated code in 45% of cases. The point is not that AI is bad. It is that AI writes what you ask for, and you usually do not ask for security. Snyk's article on vibe coding security recommends treating AI code like a junior developer's work that always needs review.

Another useful reference is the OWASP Top 10:2025, a widely used list of web application risks. Number one is Broken Access Control, followed by Security Misconfiguration. Both are exactly where vibe-coded apps often slip.

A 7-part checklist before launch

1. Access control

• Every table with user data has Row Level Security or an equivalent mechanism enabled
• Test with two accounts that neither can view or edit the other's data
• Admin pages check permissions on the backend, not just by hiding buttons on screen

2. Secrets and keys

• No secret key, service role key or password in front-end code (open the page source and search for "key" or "secret")
• Keys for pay-per-use services, such as AI APIs, are called only through the backend
• If you ever pasted a key in a chat or committed it to GitHub, revoke it and issue a new one immediately

3. User input

• Validate data on the backend, not only in the form, because people can bypass the form and send requests directly
• Text users type that is displayed back on the page must never be interpreted as code. Veracode's report points to XSS (cross-site scripting) as a very common failure for models
• Limit the types and sizes of files that can be uploaded

4. Authentication

• Use a trusted service's login system instead of having AI write its own password storage
• Password reset and email verification links work correctly

5. Dependencies

• Check that libraries the AI installed actually exist and are widely used, not similarly named lookalikes
• OWASP Top 10:2025 lists Software Supply Chain Failures as one of its main categories

6. Personal data

• Collect only what you use. Sensitive documents live in private storage
• Have a privacy policy page and a way for users to request deletion, in line with the PDPA

7. Abuse and recovery

• Rate limits on anything that calls a paid API
• A spending cap and cost alerts
• Database backups, and at least one restore you have actually tried

Example: a restaurant hiring part-time staff

The owner of a three-branch restaurant builds a part-time application site where applicants upload a copy of their ID card. Before launch she runs the checklist and finds two issues: the storage bucket is public, so anyone with a link can open files, and the applicant list page only hides its menu item, so typing the URL directly still works. She asks the AI to move files to a private bucket and add an admin check on the backend, then re-tests from a logged-out device. Had either issue reached launch day, it would have been an immediate data leak.

The gap between an app that "works" and an app you can "ship" is one checklist, and it matters a lot.

Caveats about this checklist

• The checklist catches common problems but does not guarantee the app is fully secure
• Apps holding sensitive data, such as health, financial or government documents, should be reviewed by a security professional before launch
• Asking the AI "is this app secure?" gets a vague answer. Ask one category at a time using the checklist instead

What to do next

1. Copy the 7-part checklist into your project notes
2. Have the AI review one category at a time and point to the relevant files
3. Test yourself with test accounts and a logged-out device
4. Repeat every time you add a feature that touches data or permissions

To understand permissions and keys in more depth, read Backend for Vibe Coders. If you handle job applicant data, the Plants.work article PDPA for HR helps you store that data properly.