Guide · Updated July 21, 2026

How to perform a website security check on your vibe-coded app

A website security check is a routine review of the things attackers look for first: headers, cookies, exposed secrets, auth gaps, and outdated dependencies. You do not need a security background to do one — this guide walks through the manual checks any developer can run, and the automated steps that cover the rest.

Why vibe-coded apps need this

Apps built quickly with AI assistants ship with the same public attack surface as any web app — but often without the manual review steps that catch subtle mistakes. Hardcoded API keys, missing row-level security, over-permissive CORS, and missing HTTP headers are common. A regular website security check closes that gap.

Step 1: Check your HTTP security headers

Open your site in a browser, open the network tab, and look at the response headers for the main document. Confirm you see:

• Content-Security-Policy — restricts which scripts and resources can load.
• Strict-Transport-Security — forces browsers to use HTTPS.
• X-Frame-Options or a frame-ancestors CSP directive — prevents clickjacking.
• Referrer-Policy — limits what is sent to outbound links.
• X-Content-Type-Options: nosniff — stops MIME sniffing attacks.

Step 2: Inspect your cookies

Every session or auth cookie should have HttpOnly, Secure, and a sensible SameSite value (usually Lax or Strict). Cookies missing HttpOnly can be read by any script on the page — including a compromised third-party library.

Step 3: Search your JavaScript for exposed secrets

View source on your homepage and search the bundled JavaScript for strings like sk_, service_role, SUPABASE_SERVICE, AKIA, ghp_, or Bearer. Any hit is a secret that should be rotated immediately and moved to server-side code. In AI-generated apps this is one of the most common — and most damaging — findings.

Step 4: Confirm authentication and access rules

Log out, then try to visit routes that should require an account. Try to read another user's records by changing an ID in the URL. If you use a backend with row-level security, confirm every user-facing table has policies enabled — a table without policies is either fully open or fully blocked, and both are usually wrong.

Step 5: Review your third-party dependencies

Run npm audit or your package manager's equivalent. Update packages with known vulnerabilities. Remove libraries you no longer use — every dependency is code you are trusting.

Step 6: Check DNS and email records

Even if you do not send email, missing SPF and DMARC records let attackers spoof messages from your domain. Add an SPF TXT record and a DMARC policy — this is a one-time change that dramatically reduces phishing risk.

Step 7: Automate the rest

The manual checks above cover the essentials, but a full website security check spans dozens of surfaces — sourcemap exposure, framework fingerprinting, TLS configuration, cookie prefixes, CORS policies, and more. Automating this is the point of a scanner.

VibeCoden't is built for exactly this: a website security check tuned for vibe-coded and AI-generated apps, designed so non-security experts can run it and understand the results. Paste your URL, get a scored report in seconds, and download fix prompts you can hand straight to your AI agent.

How often should you run a website security check?

Run one after every meaningful deployment and at least monthly for a live site. New routes, new dependencies, new auth flows, and new third-party scripts all change your attack surface — small changes can introduce big issues.