Revised October 2026 / By Jacob Perks
Vibe Coding Security Launch Kit
A 34-page practical security guide for founders and developers shipping AI-built apps. Test who can reach your data, what your backend actually permits and whether a fix holds up after deployment.
$29 USD. One-time purchase.
Secure Stripe checkout. Download after payment. For a lost download, email jacob@thunkle.ai from your purchase email address.
An educational resource, not a review of your app. For a developer to inspect your code and test its access controls, explore our professional security audits.
12
real application audits and reviews behind the guide
1,215
historical VAS scans, collected December 2025 to August 2026
1
exited security founder who still builds SaaS products
Try the method first
Read three pages before you buy.
The free sample shows what a scanner can establish, what it cannot and how to set up a two-account test without touching customer data. No email form. Share the sample with your developer or cofounder.
Read the free sample (PDF)The problem
Your own account is the easiest test the app will ever pass.
Most founders test the happy path: sign up, create a record, upload a file, take a payment. That proves the feature works. It does not prove one customer is blocked from another customer's records, files or actions.
The guide turns that missing boundary test into a repeatable launch routine. It shows you what to inspect, what to ask your coding agent to change and what still needs a human decision.
What is inside
A working security routine, not a list of warnings.
A pre-launch checklist
A final pass across accounts, data access, secrets, APIs, uploads, payments, backups and recovery before real users arrive.
Copy-and-paste coding prompts
Ask your coding agent to trace access controls, verify a finding and propose a bounded fix. Check AI tool permissions, private retrieval and paid jobs too.
Supabase, Firebase and RLS patterns
Worked examples for owner-scoped rows, protected fields and privileged backend functions. Know what to adapt and test rather than pasting a policy blindly.
Tests with evidence, not guesses
Set up two ordinary test accounts, prove the allowed action works, then test the forbidden one. Keep the results in a reusable release worksheet.
A scanner and developer coverage map
Separate what a deployed scan can observe from the database rules, payment logic, recovery steps and private workflows that still need review.
One month of Vibe App Scanner Go
Twenty standard scans across up to three projects, with full findings and AI-ready fix guidance. The guide shows how to check coverage and verify a fix.
Vibe App Scanner Go requires a card to redeem and renews at $19 per month unless cancelled before renewal.
Five checks to start with
Test the rules users cannot see.
- 01Can one ordinary user read or change another user's records?
- 02Does the backend enforce the same ownership rules as the interface?
- 03Did a service-role key, private token or privileged endpoint reach the browser?
- 04Can file uploads, webhooks or payment actions be called without the right account?
- 05Has anyone restored the latest backup into an empty environment?
Built from the work
Written by someone who audits and ships these apps.
Jacob Perks works in cybersecurity, including at Field Effect Software. He built and sold SecurEcommerce and now builds Vibe App Scanner, Thunkle and Content Carousel. The launch kit condenses the repeatable parts of 12 application audits and reviews. Its original research basis also includes 1,215 VAS scans from December 2025 to August 2026, a self-selected sample, not a measure of how many apps are insecure today.
Common questions.
- Who is the launch kit for?
- It is for indie founders and developers shipping an AI-built web app with tools such as Lovable, Base44, Replit, Cursor, Claude Code, Codex or Bolt. The examples are especially useful for apps using Supabase or Firebase.
- Does this replace a professional security audit?
- No. It is a practical pre-launch guide and scanner bundle, not a penetration test, compliance assessment or guarantee that an app is secure. It helps you catch common mistakes and know what to test next.
- Is it useful if the app is already live?
- Yes. The same checks apply after launch. Run them before the next release, then repeat the two-account and recovery tests whenever access rules or critical workflows change.
- How does the included Vibe App Scanner month work?
- The bundle includes one month of Vibe App Scanner Go, with 20 standard scans across up to three projects and full findings. Pro deep scans and monitoring are not included. A card is required. The first month is $0, then it renews at $19 per month unless you cancel before renewal.
- What do I receive after purchase?
- Pay $29 USD once through Stripe, then download the revised 34-page PDF from the confirmation page. The guide includes your scanner redemption instructions. Save your PDF: the private download link lasts seven days. If you close checkout or need another copy, email jacob@thunkle.ai from your purchase email address and we will verify your payment and resend it manually.
- Can I read a sample before buying?
- Yes. The free three-page sample includes the cover, scanner coverage map and safe two-account test setup. No email is required. The full kit adds the implementation examples, checklists, coding prompts, release evidence worksheet and VAS Go redemption instructions.
- I bought the earlier edition. Do I need to buy again?
- No. A valid purchase link downloads the latest edition. If your seven-day link has expired, email jacob@thunkle.ai from your purchase email address. We will verify the original purchase and send the updated PDF manually.
Security launch kit
Run the checks before real users do.
$29 USD. One-time purchase of the guide, prompts and checklist.