# VibeRescue

> Plain-English security and launch-readiness guidance for apps built with AI coding tools (Lovable, Bolt, Cursor, v0, Replit), with a free failure-pattern library and an upcoming app check.

## Key pages
- [Row Level Security disabled on Supabase tables](https://viberescue.app/patterns/supabase-rls-disabled): Supabase gives your browser a public anon key. That's safe only if Row Level Security (RLS) is on, with policies, for every table that holds user data.
- [API secret keys shipped in your frontend bundle](https://viberescue.app/patterns/secret-keys-in-frontend): Anything in client-side code is public. Env vars with NEXT_PUBLIC_ or VITE_ prefixes reach the browser, so a secret key stored there is exposed.
- [Stripe webhooks not verified](https://viberescue.app/patterns/stripe-webhook-unverified): If your webhook grants access whenever it receives a 'payment succeeded' body, anyone can fake it. Verify the Stripe-Signature header.
- [API routes with no auth check](https://viberescue.app/patterns/unprotected-api-routes): Hiding a button in the UI isn't security. Every server route must check the session and confirm the user owns the record.
- [Firebase/Firestore rules left in test mode](https://viberescue.app/patterns/firebase-open-rules): Test-mode rules allow open reads and writes. Production rules should require auth and match the document owner.
- [User uploads in a public bucket](https://viberescue.app/patterns/public-storage-buckets): Profile photos may be fine to make public. ID documents, invoices and private files are not.
- [No rate limiting on login, signup or AI endpoints](https://viberescue.app/patterns/no-rate-limiting): Without limits, bots can brute-force logins, spam signups or run up your AI bill.
- [Exposed .env or .git on a deployed site](https://viberescue.app/patterns/exposed-env-and-git): Misconfigured hosting can serve /.env or /.git/config to anyone.
- [Outdated packages with known vulnerabilities](https://viberescue.app/patterns/vulnerable-dependencies): AI tools add packages quickly and rarely update them.
- [Before you launch your vibe-coded app: 12 checks](https://viberescue.app/checklist): Twelve security checks every app built with Lovable, Bolt, Cursor, v0 or Replit should pass before launch.

## About
- [About VibeRescue](https://viberescue.app/about)
- [How we research and update content](https://viberescue.app/methodology)
- [Sponsor VibeRescue](https://viberescue.app/sponsor)
- [The VibeRescue newsletter](https://viberescue.app/newsletter)
- [Privacy policy](https://viberescue.app/privacy)
- [Terms of use](https://viberescue.app/terms)
- [Failure pattern library](https://viberescue.app/patterns)
- [VibeRescue app check: join the waitlist](https://viberescue.app/scan)
- [Fix it for me](https://viberescue.app/fix-it)
- [Security disclosure policy](https://viberescue.app/security)