Vibe-coded app security checklist

Why do vibe-coded apps need a checklist?

AI-assisted builds ship features fast. Public guardrails lag. Headers, TLS, DNS, and email auth are boring until a prospect runs a quick external check and finds gaps you did not know were visible.

The app can work in a demo and still look bad from the outside. This checklist is the cheap fix for that.

What is on the vibe-coded app security checklist?

Scan your production domain, not localhost.
Check TLS and certificate health on the live hostname.
Review security headers on deployed responses.
Verify DNS and email authentication for the domain you send mail from.
Look for public exposure signals that should not be internet-facing.
Rescan after fixes to confirm the score moved.

RedScore runs the outside-in pass in about 60 seconds. No repo upload, no platform credentials.

What should I do after the checklist?

Fix the top public failures first. Claim your domain if you want full findings, scheduled rescans, and monitoring once the app is live.

How do I run it?

Go to /lookup and enter your production domain. Do it before you paste the production URL into a sales deck or turn on payments.

Frequently asked questions

Does this checklist scan my AI-generated source code?

No. It checks public signals on your live domain. That is the fastest pre-launch check and it costs nothing to run.

Which tools does this apply to?

Any app shipped from Cursor, Lovable, Bolt, Replit, v0, or similar workflows with a public production domain.

When should I run it?

Before demos, payments, user data collection, or sending a production URL to a customer.

Is this enough before launch?

It is the right first pass. It catches public gaps fast. Deeper testing comes later if you need it.