Secrets
Environment files, provider tokens, database URLs, private keys, and public client variables.
Built with Codex, Claude, Cursor, or another coding agent
Vibe coding security before users find the gaps.
A working AI-built app can still commit a live credential, trust the browser with an admin key, skip tenant isolation, or give a deployment workflow more access than it needs. Scan the repository and the public app as two separate attack surfaces.
Five boundaries to verify
The code can pass tests and still cross the wrong boundary.
Research on AI-generated code has found that functional success does not guarantee security. The useful response is a repeatable review at the places where authority changes hands.
Authorization
Server routes and database rules that must separate users, roles, and tenants after login.
Data access
Supabase RLS, service-role placement, exposed tables, storage policies, and administrative clients.
CI and releases
GitHub Actions permissions, untrusted pull requests, mutable actions, and deployment secrets.
Public app
TLS, headers, cookies, exposed files, source maps, redirects, CORS, and browser-facing behavior.
A safer shipping loop
Run the checks where the mistake is introduced.
A production scan cannot see a private workflow file. A repository scan cannot prove that a CDN serves the right security headers. Use both.
- STEP 01
Before the first deployment
Scan the repository. Rotate any committed secret before doing anything else.
- STEP 02
Before every merge
Review workflow permissions, database migrations, and new server authorization paths.
- STEP 03
After production deploys
Scan the live URL for TLS, headers, cookies, exposed files, source maps, and redirects.
- STEP 04
After a security fix
Run a clean scan again. A deleted finding is evidence that the fix reached the public surface.
Practical security guides
Fix the risky parts first.
Committed .env or API key
Rotate it, remove it from history, and stop the next leak before push.
Read the guideAI-generated GitHub Actions
Reduce token permissions and keep untrusted pull request code away from secrets.
Read the guideSupabase and tenant data
Verify RLS, key placement, policies, storage, and server-side admin access.
Read the guideVibe coding security FAQ
What the scanners can and cannot prove.
Is vibe coding insecure?
AI-assisted code is not automatically insecure. The risk appears when generated code is accepted without reviewing secrets, authorization, database access, workflows, dependencies, and production behavior. Treat generated code as unreviewed code and verify its security boundaries before release.
Can a website scanner find a committed .env file in GitHub?
Only if the file is also publicly deployed. The current ScanMySaaS repository scanner checks security-relevant files in the repository's current tree. GitHub secret scanning should remain enabled because it can also detect supported secrets in Git history, issues, pull requests, discussions, and wikis.
Does the public repository scanner execute code?
No. ScanMySaaS reads a bounded set of security-relevant text files from a public GitHub repository. It does not clone, install dependencies, run builds, or execute repository code.
How should private repositories be scanned?
Use a GitHub App with access limited to selected repositories and read-only metadata and contents permissions. Private repository support is planned for ScanMySaaS after the public read-only scanner is validated.
Research and primary guidance