Vibe Coding Security Checklist 2026 — Ship Secure Apps with Cursor & Lovable

Why AI-Generated Code Has Security Gaps

Cursor, Lovable, Bolt, and v0 help you ship fast — but 73% of AI-generated apps are missing a Content-Security-Policy, 54% have insecure cookies, and 18% score below 40/100 on ZeriFlow.

The 12-Point Vibe Coding Security Checklist

1. Security Headers

Add to next.config.js:

async headers() {
  return [{
    source: "/(.*)",
    headers: [
      { key: "X-Frame-Options", value: "DENY" },
      { key: "X-Content-Type-Options", value: "nosniff" },
      { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
      { key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" },
    ],
  }];
}

2. HTTPS Everywhere

Every page and API route must serve over HTTPS. Vercel does this by default.

3. Cookie Security Flags

In NextAuth: cookies: { sessionToken: { options: { httpOnly: true, sameSite: 'lax', secure: true } } }

4. CORS — Your Domain Only

Never use Access-Control-Allow-Origin: * on authenticated APIs.

5. No Hardcoded Secrets

Run git grep -i 'api_key|secret|password' before every push. Use environment variables for all credentials.

6. No Debug Endpoints in Production

Remove or protect /api/debug, /api/test, and any route exposing internal data.

7. Dependency Audit

npm audit
npm audit fix

Fix high and critical vulnerabilities before shipping.

8. Rate Limiting on Authentication

Add rate limiting to /api/auth/signin and any login endpoint to prevent brute-force attacks.

9. Email Authentication

Configure SPF, DKIM, and DMARC DNS records. 38% of sites scanned by ZeriFlow fail DMARC.

10. Remove Tech Stack Headers

poweredByHeader: false in next.config.js removes X-Powered-By: Next.js.

11. TLS Enforcement

Ensure TLS 1.0 and 1.1 are disabled. Modern hosting platforms handle this automatically.

12. No Exposed .env Files

Verify .env is in .gitignore and no configuration files are publicly accessible.

Verify Everything in 60 Seconds

Go to zeriflow.com/free-scan, enter your deployed URL, and get a prioritized security report. A properly secured vibe-coded app should score above 70/100. Free, no account required.