Vibe coding is the best thing to happen to software since the compiler. It is also the best thing to happen to attackers since the default password of "admin."
Here's the part nobody posts on launch day. The same model that built your app in an afternoon will cheerfully paste your API key into a file your users can download, leave your database open to the entire internet, and then congratulate you on shipping. It isn't malicious. You asked it to make it work. "Make it safe" was never in the prompt.
And this isn't a rare edge case. When researchers actually scanned deployed vibe-coded apps, the numbers were not subtle:
Ninety-one percent. If your app were a used car, nine out of ten on the lot would have something wrong with the brakes. The single most common failure — the one we'll fix in this post — is a leaked API key.
What "a leaked key" actually means
An API key is a password for a service — OpenAI, Gemini, Stripe, your database. It proves a request is you, so the service happily does whatever is asked and bills you for it.
The mistake AI builders make constantly is putting that key in the frontend — the code that runs inside your visitor's browser. Frontend code is not a secret. It is shipped, in full, to every single person who opens your app. "View source" is a feature, not a hack.
So the path from your prompt to someone draining your account is embarrassingly short:
No firewall was breached. No password was cracked. Someone opened the browser's developer tools — which ship in every browser, for free — read the key sitting in plain text, and started spending your money. People scan GitHub and live sites for exactly this, automatically, all day.
The five-minute check (no code reading required)
You do not need to understand the code to find this. You need to search it.
On your live site: open your app, press F12 (or right-click → Inspect), go to the Sources or Network tab, and search the loaded files for these:
sk-— OpenAI and many AI providerssk_live— a live Stripe secret key (this one is an emergency)AIza— Google / Gemini keysservice_role— your Supabase master key, which ignores every security ruleSECRET,PRIVATE,AKIA— AWS and general-purpose secrets
Any hit outside a server-only file is a leaked key. If you find one, assume a stranger already has it.
A key you can see in your own browser is a key anyone can see in theirs. The only safe assumption is that it's already copied — so you rotate it, not just hide it.
While you're in there, check the database too
The runner-up to leaked keys is a wide-open database. Supabase — which most AI builders use — gives every visitor a public key. That's completely fine, but only if row-level security (RLS) is switched on. It does not start switched on.
Anyone with your public URL can read and write every row in the table.
Each user can read only their own rows. The public key is safe to ship.
With RLS off, that public key lets anyone list every row in your tables: every user, every email, every order. It's the difference between a locked mailroom and a pile of everyone's mail on the sidewalk.
The fix — paste this into whatever built your app
You don't have to fix this by hand. Hand the problem back to the tool that created it. Paste this prompt into Lovable, Bolt, Cursor, Codex, Claude Code, Base44 — whatever you used:
Find every API key or secret hard-coded anywhere in my project, including
git history and any .env file that gets deployed. For each one: move it to a
server-only environment variable that is never read in browser/client code,
add all .env files to .gitignore, and route any call that needs the key
through a server endpoint or edge function. Then list exactly which keys you
moved so I can rotate each one at its provider. Finally, enable row-level
security on every database table with policies that limit each user to their
own rows, and explain each policy in plain English.
Two things that prompt does not do: it can't rotate the keys for you (you have to do that in each provider's dashboard, because the old key is compromised the moment it was exposed), and it can't promise it caught everything. Which is the whole reason the next step exists.
Then verify it — don't take the AI's word for it
The builder that leaked the key is not a neutral judge of whether the leak is fixed. That's not a knock on the tool; it's just not its job. You want an independent second opinion before real people — and real attackers — show up.
That's what SafeLaunch does. Paste your repo or live URL and in about 30 seconds it checks for exposed keys, open databases, downloadable .env files, hidden malware and missing live-site protection, scores your app out of 100, and hands you a copy-paste fix prompt for everything it finds. The first scan is $19, re-scans are free for 7 days, and we never store your code.
Launching an app you built with AI is genuinely one of the most exciting things you can do. Just don't let the most exciting day become the most expensive one. Check for the key first.