Is VibeSecure free to use?

Yes. The interactive checklist, sources and notes are free. The optional Vibe Coder Security Pack PDF is USD 9 or KSh 1,170.

Does this site scan my code or call an AI?

No. The page is static JavaScript only. Your progress is stored in this browser with localStorage. Nothing is uploaded, and there are no AI or API calls at runtime.

How much is the Vibe Coder Security Pack?

USD 9 or KSh 1,170. Both figures are the published price. Checkout is by email until a payment link is added.

A security checklist for vibe-coded apps.

AI coding tools can get a site running in an afternoon and still leave API keys, open database rules, or an unauthenticated admin page on the public internet. This is a free, in-browser checklist for people who build with those tools. Each item is based on official public documentation. Your progress stays in this browser. There is no backend, and no AI runs on this page.

34 items, 8 topics Progress saved in this browser Security Pack: USD 9 / KSh 1,170

The checklist

Tick items as you verify them on your own project. Open “Why / how” for what to look at, what to do, and the official source. This is a self-review, not a scan of your code.

Topic

Severity

Status

How we sourced this

Each item is a practical restatement of advice published by the organisation named in its source list. The pages were checked on 12 November 2026 (Africa/Nairobi). We do not invent statistics, and we do not claim to have audited your project.

Core application issues follow the OWASP Cheat Sheet Series, the OWASP Top 10:2021, the OWASP API Security Top 10 2023, and the OWASP Web Security Testing Guide.
Supabase items follow official docs on API keys, Row Level Security, grants, and Storage access control — including the rule that secret and service_role keys must never go in a browser.
Firebase items follow the official insecure-rules guide, the security checklist, and the API-key documentation.
Backup advice follows CISA’s small-business guidance, including the 3-2-1 rule and the instruction to test restores.
If your product itself calls a language model, prompt injection is taken from OWASP LLM01:2025. That item applies to shipped AI features, not to the assistant you used to write the code.
Where a vendor’s dashboard labels or key-name formats change, treat the official page as the source of truth.

Pricing

Vibe Coder Security Pack (PDF)

USD 9 / KSh 1,170

Both amounts are the published price, not a conversion estimate. The pack is a short PDF with:

The full checklist from this page, in a form you can work through offline.
Fix snippets for common cases: .gitignore and environment layout, Supabase RLS policy shapes, replacing open Firebase rules, tight CORS headers, and basic rate limiting — with links back to the official docs.
A short pre-ship pass you can run after each AI-assisted change.

Checkout is not live yet. Use the button to email your order. You will get payment instructions that settle to the seller’s own account.

Email to buy the Security Pack

Questions

Is the checklist free?

Yes. The items, filters, sources and notes are free. Progress is stored only in this browser. The optional Vibe Coder Security Pack PDF is USD 9 or KSh 1,170.

Does this scan my repository or call an AI?

No. It is static HTML, CSS and JavaScript. There is no backend and no AI or API call at runtime. Tick boxes yourself after you have looked at your own project.

Is this a penetration test or a certification?

No. It is a self-review against published guidance. Completing it does not mean the app is secure, and skipping an item that does not apply to your stack is fine — leave it unchecked or note it yourself.

What if a source page has changed since this launch?

Use the official link on the item. The wording here was checked on 12 November 2026 (Africa/Nairobi). Vendor dashboards and key formats can change; the vendor’s current page wins.

Disclaimer

VibeSecure is information, not a security audit, penetration test, or legal advice. Official documentation can change. Confirm every control against the source page and against the way your own app is actually deployed. You are responsible for the systems you ship.