ShipSnifferWhy a checklist and not just a scanner
An automated scan sees what the public internet sees: your pages, JavaScript bundles, headers and public files. That catches a lot, including leaked keys, missing headers, exposed .env files and launch polish. It can't see your RLS policies from the inside, whether your API checks ownership, or whether your webhook grants access correctly. Those need a human (or an AI editor you point at the right question). Use the list above for the parts only you can verify, and let the free ShipSniffer scan cover the rest in 20 seconds.
The five that cause real damage
If you only have ten minutes, do these: rotate and move any secret key out of the frontend; confirm RLS or security rules on every table; make sure paid API routes require a user and are rate-limited; grant paid access only from a verified webhook; and make sure users can't read each other's data by changing an ID. These five account for nearly every "my vibe-coded app got hacked" story, and none of them is visible in a demo.
Turn each item into a prompt
Most items translate directly into a request for Cursor, Lovable or Bolt: "Check every API route in my project and add a check that the signed-in user owns the record they're requesting. Show me any route that doesn't." Ask the AI to list what it changed, then verify the riskiest ones yourself. Re-run the scan after every batch of fixes so you catch regressions; a refactor that moves a call back into the browser is easy to miss.
Free tools for the automatable parts
Use the exposed API key checker, Supabase RLS checker, Firebase config checker and security headers checker for focused checks, or the full scan to run everything at once and get copy-paste fix prompts for each issue.