Vibe Coding Security Checklist & Ship-It Kit

You built it by prompting an AI and it works. Here's what to check before real users touch it.

AI coding assistants build what you ask for. Most people don't know to ask for server-side auth checks, database rules, verified payment webhooks or tested backups, so those are the gaps that ship. This kit is the list of things to ask for, how to check the answers yourself, and copy-paste prompts that get your AI coding assistant to audit the code and propose fixes. Plain English throughout. No security background needed.

What's included

• 39-page PDF guide (US Letter, with a clickable table of contents and tick boxes on every checklist).
• Part 1: Pre-launch security checklist. 20 checks, ordered by how much damage the problem can do, each labelled MUST FIX, SHOULD FIX or GOOD HABIT. Every check has what it is in plain English, tick-box steps to test it yourself, and an audit prompt. Covers secrets in frontend code and git history, .env files, auth on every API route and server action, users reading other users' data by changing an ID, row-level security and database rules, accounts and sessions, admin routes, payment webhooks, input validation, rate limiting, AI features, file uploads, CORS, HTTPS and cookies, error messages, dependencies, logging, development leftovers and personal data. Includes a one-page quick scan and a Session Starter prompt.
• Part 2: Project brief (PRD) template. Ten sections your AI can follow (goal, users, core features, out of scope, data model, pages, stack, constraints, definition of done, working agreement), plus a complete filled example for a small client portal app.
• Part 3: Prompt library. 33 prompts in 8 groups: planning, building in small steps, debugging without breaking other things, refactoring, writing tests, reviewing AI-written code, "explain this code to me", and recovering when the AI goes in circles.
• Part 4: Deploy & backup checklist. Git habits, environment variables, database backups and test restores, domain and SSL, monitoring, rollback plan, cost alerts and a launch-day list, plus 3 deploy prompts.
• Part 5: When to get a human. Signs you need a real developer or security review (payments, health data, children, lots of users, customer security questions), who to ask, and what to hand them.
• Glossary of the terms used, in plain English.
• Prompt_Library.md and .txt: every prompt in the kit (33 library prompts, 20 audit prompts, the Session Starter and 3 deploy prompts) as text files, so copying is easy.
• Security_Checklist.xlsx: the 20 checks as a tracker with status dropdowns, notes, dates and a progress count, plus a tab with the deploy and backup checklist. Works in Excel and Google Sheets. A plain CSV copy is included too.
• PRD_Template.md: the blank brief and the filled example, ready to save as PRD.md in your project.

Who it's for

• Founders, designers, marketers and students building apps or sites with an AI coding assistant.
• Junior developers who want a structured pre-launch review.
• Anyone whose app works on their laptop and is about to get its first real users.

Good to know

• This is a digital download (a .zip). Nothing physical ships.
• Tool references are generic ("your AI coding assistant", "your hosted database"), so the kit works whichever assistant, framework and host you use. The prompts are plain text and should work with any capable AI coding assistant.
• Most prompts ask the AI for a report before it changes anything, so you stay in control of your code.
• The kit assumes you can open your project, run commands your assistant gives you, and use your browser's developer tools. Each step explains what to do.
• Not affiliated with, or endorsed by, any AI, hosting or software company.
• Personal and single-business use. Please don't resell or share the files.

An educational checklist, not a security audit, penetration test or legal advice. It will help you catch many common problems, but it can't guarantee your app is secure or compliant with any law or standard. Platforms change often, so check your providers' current documentation, and verify important changes yourself.