AI coding tools are very good at building the thing you described. The trouble is what nobody describes: the unglamorous settings that keep a site from leaking, being impersonated or getting you a letter. Here are twelve, ordered by how badly they can go wrong.
Fix before anyone sees the link
- 1. No secret keys in the browser. Search your page source for
sk_live_,sk-,AKIAandservice_role. Here’s the full check. - 2. No private files online. Visit
yoursite.com/.envandyoursite.com/.git/config. You should get a 404, not a file. - 3. HTTPS everywhere. Type your address with
http://. It should jump tohttps://on its own. - 4. Database rules switched on. On Supabase or Firebase, the public key is safe only if row-level security or rules are enabled on every table. This one needs a look inside your dashboard; an outside scan can’t see it.
Fix this week
- 5. Stop other sites framing yours. Without an
X-Frame-Optionsheader, someone can load your app invisibly inside their page and trick logged-in users into clicking. It’s called clickjacking and it’s a one-line fix. - 6. A content security policy. An allow-list of where scripts may load from, so one injected script can’t read everything your users type.
- 7. A privacy policy that matches your app. You almost certainly need one.
- 8. Consent before trackers. Google Analytics or Meta Pixel with no cookie banner is the most common legal gap we see. Cookieless analytics removes the problem.
Fix soon
- 9. Cookie safety flags. Login cookies should be
Secure,HttpOnlyandSameSite. - 10. Terms of service and a contact email. The rules of your app, and a way to reach a human.
- 11. Accessibility basics. A
langattribute, alt text on images, a real page title. Five minutes, and it’s a legal requirement in more places every year. - 12. Turn off source maps in production. Otherwise anyone can download your readable, commented source code.
Then the polish
A favicon, a share image, a sitemap and a page title that isn’t still “Vite App”. None of these will get you hacked, but they’re the difference between a site that looks finished and one that looks abandoned.
vibeliq checks eleven of these twelve from the outside in about 30 seconds (number 4 lives inside your database dashboard), grades the result, and writes a fix prompt for each problem that you paste back into Claude Code, Cursor, Lovable or whatever built the site.