Phase 8: Security, Privacy, and Judgment Traps · 30 min · Supabase · Any vibe coding tool

The Security Checklist AI Won't Run

AI writes code. It doesn't audit code. Security is your job, not the AI's.

Hiring signal: What changes when you use this: you can identify and fix security issues that AI tools miss — which means your apps don't leak user data.

What you will learn

Verify RLS is enabled on ALL tables (not just some)
Ensure no service_role key appears in frontend code
Validate all user inputs
Check for rate limiting on auth endpoints
Review CORS and CSP configuration

Your Mission

You're about to audit a real app for security holes that AI tools miss. By the end of this lesson, you'll have a completed security_audit.md that proves your app is safe to ship — or tells you exactly what to fix.

You need: Your deployed app (or one you're building), Supabase dashboard access, a terminal.

Time: 30 minutes of actual doing, not reading.

Step 1: Check RLS on Every Table (5 min)

Open your Supabase dashboard → Table Editor.

For each table in your database, check: is RLS enabled?

Do this right now:

List every table you have (e.g., habits, profiles, settings, completions)
For each one, check if RLS is enabled or disabled
Write it down in your audit file:

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers RLS Check, Step 2: Hunt for the service_role Key (3 min), service_role Key Check, Step 3: Test Every Form for Input Validation (5 min), Input Validation Check, Step 4: Verify Auth Rate Limiting (2 min), Rate Limiting Check, Step 5: Check CORS Configuration (3 min), CORS Check, Step 6: Search for SQL Injection Risk (2 min), SQL Injection Check, Step 7: Check for Swallowed Errors (5 min), Error Handling Check, You're Done — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.