AI tools like Cursor and Lovable help you ship fast — but they don't add security headers, configure CORS, or check your dependencies. This 12-point checklist covers everything to verify before your vibe-coded app goes live.
Anay Pandya
337 words
Anay Pandya
Founder of ZeriFlow · 10 years fullstack engineering · About the author
Key Takeaways
Cursor, Lovable, Bolt, and v0 help you ship fast — but 73% of AI-generated apps are missing a Content-Security-Policy, 54% have insecure cookies, and 18% score below 40/100 on ZeriFlow.
Is your site actually secure?
Run a free check — 60 seconds
Add to next.config.js:
Keep reading
async headers() {
return [{
source: "/(.*)",
headers: [
{ key: "X-Frame-Options", value: "DENY" },
{ key: "X-Content-Type-Options", value: "nosniff" },
{ key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
{ key: "Strict-Transport-Security", value: "max-age=63072000; includeSubDomains; preload" },
],
}];
}Every page and API route must serve over HTTPS. Vercel does this by default.
In NextAuth: cookies: { sessionToken: { options: { httpOnly: true, sameSite: 'lax', secure: true } } }
Never use Access-Control-Allow-Origin: * on authenticated APIs.
Run git grep -i 'api_key|secret|password' before every push. Use environment variables for all credentials.
Remove or protect /api/debug, /api/test, and any route exposing internal data.
npm audit
npm audit fixFix high and critical vulnerabilities before shipping.
Add rate limiting to /api/auth/signin and any login endpoint to prevent brute-force attacks.
Configure SPF, DKIM, and DMARC DNS records. 38% of sites scanned by ZeriFlow fail DMARC.
poweredByHeader: false in next.config.js removes X-Powered-By: Next.js.
Ensure TLS 1.0 and 1.1 are disabled. Modern hosting platforms handle this automatically.
Verify .env is in .gitignore and no configuration files are publicly accessible.
Go to zeriflow.com/free-scan, enter your deployed URL, and get a prioritized security report. A properly secured vibe-coded app should score above 70/100. Free, no account required.
Scan your vibe-coded app before you ship — free.
80+ checks in 60 seconds. Find every security gap AI tools left behind.
Related resources
Website Vulnerability Scanner
Run a broader website security audit across headers, TLS, DNS, cookies, SEO, and disclosure checks.
Security Headers Checker
Check CSP, HSTS, X-Frame-Options, and other response headers.
SSL Checker
Review TLS certificate, HTTPS, and transport security signals.
DMARC Checker
Validate email authentication records for domain spoofing protection.
CSP Checker
Review Content-Security-Policy coverage and common gaps.
May 12, 2026
Supabase Security Checklist Before Launch — RLS, Auth & API Keys
Monitor your security score
Schedule recurring scans and catch regressions after deployments.