VTResources
Field notes on securing AI-built software.
Practical guides for founders and developers shipping with AI. Every claim sourced, every fix specific, no fear-mongering.
The vibe coding security checklist: 15 checks before you deploy
A practical pre-deploy security checklist for apps built with AI assistants — secrets, access control, authentication, input handling and configuration.
- Most incidents in AI-built apps come from a short list of mistakes: exposed keys, missing ownership checks and permissive configuration.
- The “two-account test” catches the most common access-control bug in under five minutes.
- If a secret was ever committed or deployed, rotate it. Deleting it from the code is not enough.
- 02ResearchIs AI-generated code secure? What the research actually saysWhat the evidence says about AI-generated code security — Veracode’s 2025 benchmark, package hallucinations, leaked secrets and real incidents — and what to do.3 min
- 03GuideHow AI-built apps leak API keys — and how to stop itWhy secret keys end up in browser bundles and Git history in AI-generated apps, how to tell publishable keys from secret ones, and how to fix and rotate them.4 min
- 04ExplainerBroken access control: the bug AI writes most confidentlyWhy AI-generated endpoints check login but not ownership, the four forms of broken access control, a five-minute test, and patterns that fix it for good.3 min
- 05GuideSupabase Row Level Security: what AI app builders get wrongWhy Row Level Security is the real boundary in Supabase apps, five mistakes AI-built projects make with it, how to test your database, and policies that fix it.4 min
- 06ExplainerLocal vs. cloud code scanning: what changes when your code stays on your machineLocal, repository-connected and URL-based security scanning each see different things. A clear comparison of privacy, access, coverage and when to use each.3 min
Subscribe via RSS to get new guides as they’re published.
Reading is good. Checking is better.
Put these guides into practice: run a local inspection on your project and see which of these issues it actually has.
Local analysis · No repository access required