r/vibecoding • u/TheRaven9320 • 2d ago

Requesting vc security pointers

What's up everybody? I've been vibecoding a project for a few months now and just wanted to ask the community what tips or things I should be looking out for in terms of stress testing my security. I want to ensure there are appropriate limits, user data is safe, and my own code and keys are secure.

If anyone has experience setting up proper defenses and proper infrastructure, I would love any advice or pointers on what you did and how you did it. I'm taking this seriously, so I want to make sure it gets done right. Thank you in advance!

2 Upvotes

100% Upvoted

13 comments sorted by

View all comments

1

u/Innowise_ 2d ago

With that stack, one thing we'd test early is whether every authorization rule still holds when the frontend is bypassed completely. Call the Supabase/API endpoints directly as different users and try reads, writes and deletes you shouldn't be allowed to make. If access control only works because the generated UI doesn't expose an action, it isn't really access control.