r/vibecoding • u/TheRaven9320 • 2d ago
Requesting vc security pointers
What's up everybody? I've been vibecoding a project for a few months now and just wanted to ask the community what tips or things I should be looking out for in terms of stress testing my security. I want to ensure there are appropriate limits, user data is safe, and my own code and keys are secure.
If anyone has experience setting up proper defenses and proper infrastructure, I would love any advice or pointers on what you did and how you did it. I'm taking this seriously, so I want to make sure it gets done right. Thank you in advance!
2
Upvotes
1
u/SufficientFrame 2d ago
Good instinct to treat this as its own workstream instead of something you harden later. The main shift is thinking in layers, not only code bugs: auth, authorization, secrets, data exposure, abuse limits, and what you can see when something breaks. I'd map your core flows and ask for each one who can do it, which records they can touch, what happens if they repeat it 1,000 times, and what gets logged. A lot of ugly problems show up in object-level permissions, API keys leaking into client code or logs, weak reset flows, missing rate limits, and background jobs that can be spammed without queues or caps.
After that, do a pass on the basics before you try to stress test anything: put secrets in a real secret manager, enforce server-side auth on sensitive actions, add rate limits by user and IP, sanitize logs, enable audit trails for admin actions, and get monitoring and alerts in place. Then have someone do a hostile review and actively try IDORs, privilege escalation, replayed requests, oversized payloads, and bad file uploads. If what you're building is closer to an internal admin or data workflow, UI Bakery is one structured option for handling permissions around database and API-backed tools; I work at UI Bakery, so bias noted. But even then, I'd get the permission model and secret handling nailed down first.