Failure pattern library

Quick answer: Common security mistakes in apps built with AI coding tools, with defensive self-checks and fixes for your own app.

Row Level Security disabled on Supabase tables: Supabase gives your browser a public anon key. That's safe only if Row Level Security (RLS) is on, with policies, for every table that holds user data.
API secret keys shipped in your frontend bundle: Anything in client-side code is public. Env vars with NEXT_PUBLIC_ or VITE_ prefixes reach the browser, so a secret key stored there is exposed.
Stripe webhooks not verified: If your webhook grants access whenever it receives a 'payment succeeded' body, anyone can fake it. Verify the Stripe-Signature header.
API routes with no auth check: Hiding a button in the UI isn't security. Every server route must check the session and confirm the user owns the record.
Firebase/Firestore rules left in test mode: Test-mode rules allow open reads and writes. Production rules should require auth and match the document owner.
User uploads in a public bucket: Profile photos may be fine to make public. ID documents, invoices and private files are not.
No rate limiting on login, signup or AI endpoints: Without limits, bots can brute-force logins, spam signups or run up your AI bill.
Exposed .env or .git on a deployed site: Misconfigured hosting can serve /.env or /.git/config to anyone.
Outdated packages with known vulnerabilities: AI tools add packages quickly and rarely update them.

Get on the VibeRescue waitlist

App checks aren't available yet. Join the waitlist to hear when they open.