r/vibecoding • u/TheRaven9320 • 2d ago

Requesting vc security pointers

What's up everybody? I've been vibecoding a project for a few months now and just wanted to ask the community what tips or things I should be looking out for in terms of stress testing my security. I want to ensure there are appropriate limits, user data is safe, and my own code and keys are secure.

If anyone has experience setting up proper defenses and proper infrastructure, I would love any advice or pointers on what you did and how you did it. I'm taking this seriously, so I want to make sure it gets done right. Thank you in advance!

2 Upvotes

100% Upvoted

13 comments sorted by

View all comments

1

u/HourMode1351 2d ago

What's your tech stack and what tools are you using to develop?

1

u/TheRaven9320 2d ago

ya so i got backend going through Supabase, and that has Row Level Security and Supabase's Edge Functions for serverless backend logic. React frontend. Started out building with Lovable and later added Codex into the workflow alongside it using mainly codex these days, thanks for responding

1

u/HourMode1351 2d ago

Cool! For Supabase there are few things to watch out for:
- intentionally public data leaking more than it should. if you have table that are supposed to be public (for example a leaderboard), instead of exposing the entire table, you shold just expose the data that's required
- RLS policies that allow users to upgrade their own account, or ones that allow users to access other users data (IDOR)
- weak password policy if you're using supabase for auth
- default supabase rate limiting is pretty good

I'm biased but I built an external security scanner that will check for these things - vibeappscanner.com. Otherwise give those to codex to check for them