Security Review for Vibe Coders · 30 min · Claude Code, Cursor, Lovable, v0, Bolt.new, Replit Agent, or similar

Your Pre-Launch Security Pass

A checklist you never run under a deadline isn't a checklist — it's a good intention. This lesson makes it a habit.

What you will learn

Combine a threat model, a five-point check, and a verified AI review into one real report
Make and justify a ship / fix-first / hire-someone decision based on actual findings
Recognize the specific situations that call for a professional security review instead of self-service checks

Objective

Combine the threat model, five-point check, and AI review/verification into one real report on a real app, ending in an honest ship / fix-first / hire-someone decision.

This is the lesson where everything from the last three comes together into one real habit: a security pass you actually run before every launch, not just for this course.

The Problem

Knowing the five checks and having a good prompt doesn't help if you never actually run the pass — under a deadline, "I'll check security later" quietly becomes "I never did." This lesson turns Lessons 1-3 into one repeatable sequence, plus the one judgment call none of the previous lessons could make for you: when to stop doing this yourself and pay a real engineer.

The full pass, in order

Threat model (Lesson 1): what does this app store, does it have login, does it call paid APIs from the browser? (threat-model.md)
Five-point check (Lesson 2): exposed secrets, database access rules, authorization, input validation, headers. (five-point-check.md)
AI review and verification (Lesson 3): run /security-review or the prompt, then independently verify one claim. (ai-review-output.md, verification-notes.md)
Fix what you found. For anything marked "not checked" or failing in step 2 or 3, ask your AI tool to fix it specifically — not "make my app secure," but the exact item ("add row-level security to the orders table so users can only read their own rows").
Re-run the check on anything you fixed. A fix isn't done until you've verified it the same way you verified step 3.

A trap: fixing without re-checking
It's tempting to ask your AI tool to fix an issue, see it say "fixed!", and move on. That's the exact same unverified trust this course has been warning about, just one step later. Re-run the specific check on anything you "fixed" before considering it closed.

Knowing when to call a real engineer

This course gives you a real, useful pass — it does not make you a security engineer. Call in professional help (a paid security review, or a developer with real security experience) before launch if any of these are true:

Your app stores anything genuinely sensitive: health information, financial data, government IDs, anything you'd be legally responsible for
You're charging real money through your own payment integration, not a hosted checkout page
You have any signal that someone has already tried to probe or attack your app
You've gone through this whole pass and still don't understand why an issue exists, only that your AI tool says it fixed it

None of this is a failure of the course — it's the honest edge of what a checklist and a prompt can do alone. A professional review for a small app is a real, bounded cost; a breach involving real user data is not.

You've run the full pass on your app. Every check passed, and you verified two of the claims yourself. Your app is a personal to-do list tool with no login and no payment. What's the right call?

The bar here scales with what's actually at stake (from Lesson 1's threat model) — a no-login, no-payment personal tool that passed a real, verified check doesn't need a professional review to justify its cost. That same pass on an app handling health data or real payments would call for the hire-someone list above. And "it passed once" is exactly why you re-verify every time you change something, not a reason to stop checking.

Your practice rep — the real pre-launch pass

Using your actual app (or the one you've been building across this course):

Combine threat-model.md, five-point-check.md, ai-review-output.md, and verification-notes.md into one file: security-review-report.md.
Add a final section: Decision — write your honest call: ship it, fix these specific things first, or hire someone before launch — and one paragraph justifying it using what you actually found, not a guess.
If your decision is "fix these things first," list exactly what, then go fix and re-verify them before you consider this Practice Rep done.

This report and decision are the actual deliverable of this course — not a certificate claim, a real document about a real app.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Build, Check Yourself, Key Terms & Next — plus a hands-on lab, quiz, and project artifact.

Create a free account — the opening phases of 29 of 35 courses are free, no credit card.