The Vibe Code Security Kit
Anyone can see data they shouldn't, not just through your database. Exposed API keys, missing authorization checks, and broken auth flows are just as common. Here's every prompt we use in a paid review to catch all of them, whatever stack you're on.
From €29 · Instant delivery · No account required · Works on any stack (Supabase, Firebase, PlanetScale, or your own backend)
Built for developers who shipped fast and skipped the audit.
You shipped an app
It works, it's live, and you haven't looked under the hood since the AI wrote it.
You have real users
People are signing up, storing data, paying you. A breach isn't hypothetical anymore.
You built it with AI tools
Lovable, Bolt, v0, Cursor, or Claude Code wrote most of your backend. You reviewed the UI, not the access rules.
5 vulnerability categories. 14 prompts. Not just your database.
The same categories we check in a paid review, so you can recognize your own risk before you see a single price.
Keys & secrets exposed
API keys shipped to the browser, service-role keys with more access than the client needs, and environment variables that leak into your JavaScript bundle.
Example finding
A Supabase service-role key got bundled into the client-side JavaScript of a live app, handing full database read/write access to anyone who opened dev tools.
Access control
Two dedicated prompts: IDOR Audit (finds every place a resource ID is trusted from the URL without checking the current user owns it) and Admin Route Audit (finds every /admin, /dashboard, or /internal route missing a role check, not just a login check), plus a general missing-authorization sweep across your API routes.
Example finding
A document storage bucket was reachable by anyone who guessed the URL: no login, no ownership check, just a predictable filename.
Database
Row-level security that's missing, misconfigured, or technically present but bypassable, plus SQL views that expose more than intended.
Example finding
Row-level security was enabled on an orders table but no policy was attached, which defaults to letting any signed-in user read every customer's orders.
Authentication
Weak session handling, no rate limiting on login or password reset, and OAuth or JWT flows implemented in a way that leaks or mishandles tokens.
Example finding
A JWT was passed as a URL query parameter instead of a secure header, so it ended up logged in plain text in server logs and browser history.
Inputs & webhooks
Unvalidated input that opens the door to injection, and webhook endpoints that don't verify who's actually calling them.
Example finding
A Stripe webhook endpoint accepted requests without checking the signature, so anyone who found the URL could fake a "payment succeeded" event.
Before / after
create policy "documents_all"
on public.documents
for all
using ( true );A single USING (true) policy looks like it works, and quietly lets anyone read or write any row.
create policy "documents_select_own"
on public.documents
for select
to authenticated
using ( (select auth.uid()) = user_id );
create policy "documents_update_own"
on public.documents
for update
to authenticated
using ( (select auth.uid()) = user_id )
with check ( (select auth.uid()) = user_id );Scoped to the current user, with WITH CHECK to stop them reassigning rows to someone else.
The same issues we find in paid reviews, in apps built with AI tools.
Anonymized findings from real Validra audits, the kind of thing the Kit's prompts are built to catch.
Missing RLS on orders table
The orders table had row-level security enabled but no policy attached, which defaults to allowing full access to any authenticated user.
Impact
Any signed-in user could read every customer's orders, addresses, and order totals.
Service-role key shipped to the browser
A Supabase service-role key was assigned to a variable without the NEXT_PUBLIC_ prefix convention check, and got bundled into client-side JavaScript.
Impact
Full read/write access to the database, bypassing RLS entirely, exposed to anyone visiting the site.
Public storage bucket with user uploads
An uploads bucket was left public for convenience during development and never locked down before launch.
Impact
User-uploaded documents and images were listable and downloadable by anyone with the bucket URL.
Findings anonymized. Full audit trail available on request.
Three ways to get it.
No subscription, no account. One-time payment, instant delivery.
Starter
The 14 audit prompts across all 5 categories.
- 14 audit prompts covering keys & secrets, access control, database, auth, and input validation. Paste into Cursor, Claude Code, or your AI tool of choice and run in minutes
- Includes the IDOR Audit and Admin Route Audit prompts
- Works with any AI coding assistant: Cursor, Claude Code, Copilot, or your own
- Works on any stack: Supabase, Firebase, PlanetScale, or a plain Node backend
Core
Starter, plus the templates and scripts to prove your fixes actually work.
- Everything in Starter (14 prompts, 5 categories)
- 8 policy templates (RLS and equivalent access-control patterns), ready to copy-paste
- SQL verification scripts that prove, with evidence, whether one user can read another's data
- Built for Postgres-based stacks; the 14 prompts still apply to any stack
Complete
Core, plus the full security checklist and a walkthrough with the founder.
- Everything in Core (14 prompts, 8 policy templates, SQL scripts)
- Checklist of the 25 most common findings, run anytime, not just once
- Hardening guide: the reasoning behind each fix, so your team stops reintroducing the same mistakes
- 20-minute Loom walkthrough, recorded by Téo, showing exactly how to use the kit on a real app
Why not just ask ChatGPT?
You can. Generic prompts about "security best practices" will get you generic answers about password hashing and HTTPS, true, but not what breaks AI-built apps. These prompts are narrow on purpose: they target the specific failure modes we see over and over in access control, exposed keys, database policies, and webhook handlers built by AI coding tools. That specificity is the product.
Questions before you buy.
What if I'm not happy with it?
Email me within 14 days and I'll refund you, no questions asked.
How is it delivered?
A link to a private page with everything included in your tier, plus a downloadable PDF, sent to your email right after payment.
What stacks does this support?
The prompts work with any AI assistant on any stack: Supabase, Firebase, PlanetScale, or a plain Node backend. The access-control policy templates in Core and Complete are written for Postgres-based stacks (Supabase and similar); the rest of the kit applies everywhere.
How technical do I need to be?
You need to be comfortable pasting a prompt into your AI coding assistant, and comfortable running SQL against your database if you pick Core or Complete. If you shipped an app, you already have both skills.
How is this different from a Validra review?
The Kit tells you where to look and gives you the tools. A Validra review is us actually looking: manual testing, cross-account access attempts, and a written report you can hand to an investor or customer.
If you'd rather have someone else run the audit, book a Security Review.
Same categories, done manually, with a report you can act on in a day.