Vibe-proof: security hardening for full-stack apps

Purpose: Audit and fix security vulnerabilities in vibe-coded full-stack applications through parallel multi-layer analysis and guided remediation, fixing in severity order.

Origin

Refined across two real hardening sessions: a React + Express + Stripe e-commerce platform deployed to Vercel, then a Next.js + Supabase + CRM medical platform. Between both sessions, 85+ issues were found, including SQL injection, hardcoded backdoor passwords, secrets in URL params, .env files in git, and missing security headers.

When to use

• After vibe-coding an MVP with API routes, databases, or payment integrations
• Before a first real deployment or first real customer
• When you suspect "it works, but is it safe?"
• Any Express / React / Next.js / Nuxt app with a backend

The seven security checks

1. Injection vectors