# ShipSecurely > Ship your vibe-coded app without getting hacked. Plain-English guides to the ways apps built with Cursor, Claude Code, Lovable, Bolt, Replit, and v0 get hacked, plus a pre-launch checklist and a directory of security tools. This site does not invent statistics or quotes. Tool pages record what was checked on a public page and list anything still unknown. Guides are practical notes for people who built an app with an AI coding tool. They are not a penetration test and not legal advice. HTML pages have a markdown alternate at the same path with `.md` added. Prefer those when citing a page. ## Issues - [Auth checked only in the UI](https://shipsecurely.dev/issues/auth-checked-only-in-the-ui.md): Hiding a button or a page does not stop a request. The server, the database policy, or both have to reject it. - [Exposed .env files and debug endpoints](https://shipsecurely.dev/issues/exposed-env-and-debug-endpoints.md): A public .env, a /api/debug route, or a client bundle that prints config hands your secrets to anyone who asks. - [Firebase rules left open](https://shipsecurely.dev/issues/firebase-rules-left-open.md): Firestore or Storage rules that allow any read and write make the database public. The client SDK will do whatever the rules allow. - [IDOR: reading or changing someone else's data](https://shipsecurely.dev/issues/idor.md): The request carries an id, and the server fetches that id without checking that it belongs to the signed-in user. - [Keys committed to GitHub](https://shipsecurely.dev/issues/secrets-committed-to-git.md): A key in a commit is copied to every clone and to GitHub's history. Deleting the file in a new commit does not remove it. - [No cap on LLM API spend](https://shipsecurely.dev/issues/unbounded-llm-spend.md): A model route with your key and no limit is a meter anyone can run. One script can spend a month of budget in an afternoon. - [Open storage buckets](https://shipsecurely.dev/issues/open-storage-buckets.md): A public bucket, or a storage policy of allow-all, lets anyone with the URL read files other users uploaded. - [Secret keys shipped in the frontend](https://shipsecurely.dev/issues/secret-keys-in-the-frontend.md): A Supabase secret key, Stripe secret key, or model API key in the browser bundle is public. Anyone can copy it and use it as your server. - [Server Actions with no auth check](https://shipsecurely.dev/issues/server-actions-without-auth.md): A Server Action is a public POST. 'use server' does not mean only your button can call it. - [Supabase tables without row level security](https://shipsecurely.dev/issues/supabase-tables-without-rls.md): Tables in the public schema are reachable through the Supabase API. With row level security off, the publishable key is enough to read and change every row. - [The client sets the price, role, or plan](https://shipsecurely.dev/issues/client-sets-price-or-role.md): If the browser can send amount, plan, or role and the server saves it, users will send the values they want. - [Unverified Stripe webhooks](https://shipsecurely.dev/issues/unverified-stripe-webhooks.md): A webhook is a public URL. If you trust the JSON without checking Stripe's signature, anyone can tell your app that a payment succeeded. - [CORS wide open](https://shipsecurely.dev/issues/cors-wide-open.md): Reflecting any website's Origin and allowing credentials means that website can call your API as the logged-in user. - [Cross-site scripting (XSS)](https://shipsecurely.dev/issues/xss.md): User content rendered as HTML runs in your origin. It can read that user's data and call your API as them. - [No rate limiting on auth or paid API routes](https://shipsecurely.dev/issues/no-rate-limiting.md): Login, password reset, and any route that calls a paid API will accept as many requests as an attacker sends, until the bill or the user list gives out. - [Prompt injection in LLM features](https://shipsecurely.dev/issues/prompt-injection.md): Text you feed a model, including user messages and documents it reads, can contain instructions. If the model can call tools, those instructions can become actions. - [SQL injection](https://shipsecurely.dev/issues/sql-injection.md): User input glued into a SQL string can change the query. The database then runs the attacker's statement with your connection's privileges. - [Unsafe file uploads](https://shipsecurely.dev/issues/unsafe-file-uploads.md): An upload that trusts the browser's file type, keeps the original name, or serves the file from your site can become stored XSS or a malware host. - [Weak password reset](https://shipsecurely.dev/issues/weak-password-reset.md): A reset flow that uses a short code, a guessable link, or a client-only check lets someone take the account without the password. - [Missing privacy policy and terms](https://shipsecurely.dev/issues/missing-privacy-policy-and-terms.md): If you collect accounts, emails, or payments, you need a page that says what you collect and a page that says the rules of the product. This is not legal advice. - [Missing security headers](https://shipsecurely.dev/issues/missing-security-headers.md): Headers tell the browser not to sniff content, not to load you in a frame, and which scripts are allowed. They limit damage, and they do not replace auth. - [Outdated dependencies](https://shipsecurely.dev/issues/outdated-dependencies.md): A lockfile full of old packages is a pile of known bugs you have not looked at. Some are security fixes and some are noise, so you still have to look. ## Tools - [Aikido](https://shipsecurely.dev/tools/aikido.md): One dashboard for dependency, code, secret, and cloud findings when you do not want to assemble separate scanners. - [Snyk](https://shipsecurely.dev/tools/snyk.md): Scanning dependencies, code, containers, and infrastructure-as-code from an IDE, CLI, or git host, with a free plan for individuals and small teams. - [GitHub code scanning](https://shipsecurely.dev/tools/github-code-scanning.md): Finding insecure patterns in a repository's code with CodeQL, especially on a public GitHub repo. - [Semgrep](https://shipsecurely.dev/tools/semgrep.md): Pattern-based code scanning you can run locally or connect to GitHub, with a free cloud tier for small teams. - [Supabase Security Advisor](https://shipsecurely.dev/tools/supabase-security-advisor.md): Catching Supabase-specific mistakes such as public tables with row level security disabled. - [GitHub Dependabot](https://shipsecurely.dev/tools/github-dependabot.md): Alerts and pull requests when a dependency you already use has a known vulnerability. - [npm audit](https://shipsecurely.dev/tools/npm-audit.md): A local look at known vulnerabilities in the packages already installed in a JavaScript project. - [Socket](https://shipsecurely.dev/tools/socket.md): Catching malicious or surprising dependency behavior, not only packages that already have a CVE. - [OWASP ZAP](https://shipsecurely.dev/tools/owasp-zap.md): Exercising a running site you are allowed to test, with a proxy aimed at people who are new to security testing. - [Stripe CLI](https://shipsecurely.dev/tools/stripe-cli.md): Forwarding Stripe webhook events to a local server so you can test signature verification. - [GitHub secret scanning](https://shipsecurely.dev/tools/github-secret-scanning.md): Finding known credential patterns that were committed to a GitHub repository, and blocking some pushes before they land. - [Gitleaks](https://shipsecurely.dev/tools/gitleaks.md): Searching a git history for secrets from your own machine or from CI. - [Cloudflare Radar URL Scanner](https://shipsecurely.dev/tools/cloudflare-radar-url-scanner.md): A quick public report on what a URL loads and whether Cloudflare had a malicious-content verdict. ## Guides - [Catalog data](https://shipsecurely.dev/data): Counts of published issue guides by category and severity, with the counting method. - [Scanner comparisons](https://shipsecurely.dev/tools/compare): Alphabetical tables of other scanners. Not a ranking. - [Pre-launch security checklist](https://shipsecurely.dev/checklist.md): A single pass over the issues that most often ship in an AI-built app, before you send the URL to anyone else. - [About](https://shipsecurely.dev/about.md): What this reference is, and how the pages are written. - [Privacy](https://shipsecurely.dev/privacy.md): What this version of the site stores when you use the newsletter form, and what it does not do. - [Sponsor](https://shipsecurely.dev/sponsor.md): $99 per week for the sitewide sponsor bar and a Sponsored by line in that week's newsletter. Up to 4 weeks at once. The price rises after each sale. - [For AI assistants](https://shipsecurely.dev/for-llms.md): How to cite this site. ## Optional - [Full text](https://shipsecurely.dev/llms-full.txt): Every issue guide in one markdown file. Skip this if you only need the index.