Security for indie SaaS and vibe-coded apps

A small SaaS or an app built with an AI coding assistant ships fast, and the same few mistakes ship with it: secrets in the client bundle, admin routes without checks, dependencies nobody reviewed.

The articles here are written for the founder who owns the code: what to check on your own app, in what order, and how to fix what you find, without a security team.

AppMap maps your app's pages and API endpoints with the auth each requires, so you can see what a visitor can reach.

Articles

• Hardcoded credentials in your JavaScript bundle: how to check and fix

  A test login left in front-end code ships to every visitor, and "unused" does not mean "invalid". Learn how credentials end up in a JavaScript bundle, how to search your own build and source maps for them, and how to keep them out.

• Security checklist for vibe-coded and indie SaaS apps

  A seven-item security checklist for apps built fast with AI coding tools and small SaaS: secrets in the bundle, endpoint auth, object ownership, Supabase RLS, webhook signatures, headers and dependencies — each with a check you can run on your own app.

• Software Supply Chain Security: A Defense-in-Depth Architecture

  Move beyond compliance checklists. Learn to architect a resilient software supply chain using SBOMs, SLSA provenance, Sigstore, and runtime enforcement.