Vibecode Hardening Kit

You built the whole house.
Nobody sold you a deadbolt.

I audited 40 apps built with the popular describe-it-and-ship-it tools. The scary stuff (leaked keys, exposed secrets) mostly wasn't there. But almost none of them locked the front door. Check yours in one click.

0 leaked secret keys in 40 apps 92% shipped with no CSP fix = ~5 minutes

Check your front door

Runs in your browser. One request to your app, same as a normal visit. Nothing is stored or sent anywhere.

Browsers hide some cross-site response headers from JavaScript, so an in-page check can under-report. For the exact result, run check-headers.sh from the kit.

Install the lock

Pick where your app is deployed. Copy the block. Redeploy. Adjust the CSP allow-list to the domains your app actually calls.

The lock this page can't see
If you're on Supabase, your anon key is public by design -- that's not a leak. What decides if your data is safe is Row Level Security, and it lives on the server where no scan can reach it. With RLS off on an API-exposed table, anyone who opens dev tools can read every row in it. Check your OWN project (dashboard or a SQL query) -- see snippets/supabase-rls.md. Worth doing even if your header score is an A.