Security Review for Vibe Coders · 20 min · Claude Code, Cursor, Lovable, v0, Bolt.new, Replit Agent, or similar
The Problem
Handing your code to an AI and asking "is this secure?" almost always gets you a reassuring "yes, this looks good!" — even when it isn't. AI tools have a well-documented tendency to agree with whatever you bring them (sometimes called the "sycophant problem"). The fix isn't to stop asking AI to review code — it's to ask more specifically, and to check the answer yourself before trusting it.
If you use Claude Code: there's a built-in command
Claude Code ships a /security-review slash command. Open Claude Code in your project and run:
/security-review
This scans your pending changes for the same categories from Lesson 2: exposed secrets, SQL injection, broken authentication and authorization, unsafe data handling, and known-vulnerable dependencies. You can customize what it checks for your project by copying its command file into .claude/commands/security-review.md and editing it — for example, adding a line that specifically calls out your database's access-rule setup if you're using Supabase or Firebase.
If you use anything else: a prompt that works almost anywhere
Copy this into Lovable, v0, Bolt, Cursor, ChatGPT, or any AI coding tool, right before you ship:
Review this app specifically for security issues, not general code quality. Check for:
1. Any API key, password, or secret that appears in client-side/browser code instead of a server environment variable
2. Any database table without row-level security (or equivalent access rules) enabled
3. Any place that fetches a specific record by ID without checking that it belongs to the current logged-in user
4. Any place user input is inserted into a query or command without sanitization
5. Missing standard security headers
For each issue found, show me exactly where it is and what the fix looks like. If you checked something and found no issue, tell me specifically what you checked, not just "looks good."
That last sentence is the important one.
If it can't show you, it didn't do it
The single most useful habit in this whole course: when an AI tool says "your app is secure" or "I've handled that," ask it to show you exactly what it checked and where. A real check produces a specific answer — "table orders has RLS enabled with policy X" — not a vague reassurance. If it can't point to the specific thing it verified, treat it as unverified, not as done.
Reviewing a diff instead of a whole app
Once your app exists and you're just adding a new feature, you don't need to re-review everything — just the new change. Paste the diff (the AI tool's summary of what it just changed, or the actual code diff if you have one) with this prompt:
You're reviewing a diff, not the whole codebase. Focus only on correctness, security, and whether this change touches anything from my five-point security check (secrets, database access rules, authorization, input validation, headers). Call out any of those specifically if this diff touches them. Don't suggest unrelated refactors.
This keeps the review fast and focused on what actually changed, which is realistically the only way you'll do this every single time you ship something new.
You paste your app into an AI tool and ask "is this secure?" It replies: "Yes, I've reviewed it and everything looks secure." What should you do next?
"Everything looks secure" with no specifics is exactly the sycophantic, unverifiable answer this lesson warns about. Asking a second AI tool the same vague question just gets you a second vague answer — the fix isn't a different AI, it's a more specific question and a demand for specifics back.
Your practice rep
Run one real security review on your actual app right now:
- If you have Claude Code, run
/security-review. Otherwise, paste the prompt above into whatever tool you used to build your app. - Save the full, unedited output to
ai-review-output.md. - Pick exactly one claim it made (for example, "table X has RLS enabled") and verify it yourself — check the actual dashboard or settings, not just the AI's word. Write two sentences in
verification-notes.md: what you checked, and whether the AI's claim held up.