Best Practices and Security for Vibe Coders

Secrets

The most common mistake is putting an API key in frontend code. Anyone can view that code in the browser.

Use a server environment variable for secret keys. Add the env file to gitignore. Set the same names in the host's dashboard.

Sign-in

Use a maintained provider such as Clerk or Supabase Auth. Do not invent password hashing for a first product. Add a limit to public forms so a script cannot submit thousands of notes.

What to read yourself

Read the generated code when it handles personal data, payments, sign-in, or database writes. Ask what happens with an empty field, a very long field, and a second click on Pay.

Before launch

• Secret keys are not in the repository or the browser bundle.
• Protected pages check the signed-in user on the server.
• Forms check input on the server.
• Error text does not include secrets or other people's emails.
• The site is served over HTTPS.
• Database tables that hold emails are not readable by anonymous visitors.
• Public forms have a rate limit.
• You know how to export or back up the database.
• Privacy and terms pages match what the site actually does.

Key takeaways

• Secrets stay on the server.
• Use a known sign-in product.
• Review code that moves money or personal data.
• Click through the unhappy paths before you invite users.