# Security for indie SaaS and vibe-coded apps

Canonical: https://hackergpt.org/blog/topic/saas-security/

A small SaaS or an app built with an AI coding assistant ships fast, and the same few mistakes ship with it: secrets in the client bundle, admin routes without checks, dependencies nobody reviewed.

The articles here are written for the founder who owns the code: what to check on your own app, in what order, and how to fix what you find, without a security team.

[AppMap](https://hackergpt.org/features/appmap/) maps your app's pages and API endpoints with the auth each requires, so you can see what a visitor can reach.

## Articles

- ### [Hardcoded credentials in your JavaScript bundle: how to check and fix](https://hackergpt.org/blog/hardcoded-credentials-javascript-bundle/)

  A test login left in front-end code ships to every visitor, and "unused" does not mean "invalid". Learn how credentials end up in a JavaScript bundle, how to search your own build and source maps for them, and how to keep them out.

- ### [Security checklist for vibe-coded and indie SaaS apps](https://hackergpt.org/blog/vibe-coded-app-security-checklist/)

  A seven-item security checklist for apps built fast with AI coding tools and small SaaS: secrets in the bundle, endpoint auth, object ownership, Supabase RLS, webhook signatures, headers and dependencies — each with a check you can run on your own app.

- ### [Software Supply Chain Security: A Defense-in-Depth Architecture](https://hackergpt.org/blog/software-supply-chain-security-a-defense-in-depth-architecture/)

  Move beyond compliance checklists. Learn to architect a resilient software supply chain using SBOMs, SLSA provenance, Sigstore, and runtime enforcement.