10 things to check in a vibe-coded app before you let real users in.
A 30-minute self-audit you can run today. If you fail more than 3, don't launch — patch first.
1. RLS enabled on every user-data table. 2. No service_role or admin keys in the client bundle (check your built JS in DevTools). 3. Rate limit on /auth/signup and /auth/reset. 4. Email confirmation required before account is active. 5. File uploads have size + MIME caps. 6. Webhooks verify signatures. 7. No 'any' or '@ts-ignore' on a money path (Stripe, billing, refunds). 8. Error reporting (Sentry or equivalent) wired in. 9. A health check endpoint, pinged by an uptime monitor every minute. 10. You've actually run the signup → checkout → logout flow on a fresh device this week.
If you fail 4 or more, your launch is going to be more painful than you think. We have a 50-point version of this list as a PDF — it's the same one we use internally on every audit.