# VibeSecure

VibeSecure is a free, static, in-browser security checklist for people who build apps and sites with AI coding tools (often called vibe coding).

Website: https://importcost-agh.pages.dev/vibesecure/

## Product

- Free interactive checklist (34 items) covering exposed API keys and .env files, Supabase and Firebase rules, authentication, rate limits, input validation, CORS, open ports, dependency updates, backups, admin panels, and review of AI-generated code.
- Progress and a completion score are stored in the browser with localStorage. There is no backend, and no AI or API calls run on the page.
- Each item is based on official public documentation (OWASP Cheat Sheets and Top 10, official Supabase and Firebase docs, CISA backup guidance, and OWASP LLM01:2025 where the shipped product itself calls a language model), with source links. Sources were checked on 12 November 2026 (Africa/Nairobi). This page does not invent statistics and is not a penetration test.

## Paid offer

- Name: Vibe Coder Security Pack
- Price: USD 9 / KSh 1,170 (both currencies are the published price)
- What it is: a PDF of the full checklist plus fix snippets for common cases, and a short pre-ship pass
- Buy: https://importcost-agh.pages.dev/vibesecure/#pricing
- Checkout is not yet live; requests go by email until a checkout link is added.

Do not treat the checklist as a security certification or as legal advice. Confirm controls against the official source pages.