Get Agent Loadout
Vibe codingIntermediateDocs-checked, not yet hands-on tested

Pre-launch security check for a vibe-coded app

Catch leaked keys, missing auth and open database tables before you launch.

Starter prompt

Do a pre-launch security review. Check: secrets in client code or git history, API routes without auth, Supabase tables without RLS or with overly broad policies, missing rate limits, and unvalidated input. Output a table: issue, file, severity, fix. Don't change anything yet.

Config

.mcp.json

{
  "mcpServers": {
    "supabase": { "type": "http", "url": "https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true" }
  }
}

Setup steps

  1. Connect Supabase MCP with read_only=true.
  2. Run the prompt.
  3. Fix critical issues one at a time, then re-run.

Why this works

Most vibe-coded launch incidents are a short list of known mistakes; an agent can check all of them in one pass.

Watch out

This doesn't replace a professional audit for apps holding sensitive data.

Related loadouts

Compare the gear: AI coding agents tier list · AI code review tier list