A self-serve field guide by Jacob Perks
Vibe Coding Security Launch Kit
A 27-page practical security guide for founders and developers shipping AI-built apps. Use it to test the access rules, keys and workflows that a working demo does not prove.
$29 USD. One-time purchase.
Secure Stripe checkout. Download after payment. For a lost download, email jacob@thunkle.ai from your purchase email address.
An educational resource, not a review of your app. For a developer to inspect your code and test its access controls, explore our professional security audits.
Field guide 01
Vibe coding security.
The checks, prompts and fix patterns to run before your app gets real users.
12
real application audits and reviews behind the guide
1,200+
Vibe App Scanner scans informing the recurring patterns
1
exited security founder who still builds SaaS products
The problem
Your own account is the easiest test the app will ever pass.
Most founders test the happy path: sign up, create a record, upload a file, take a payment. That proves the feature works. It does not prove one customer is blocked from another customer's records, files or actions.
The guide turns that missing boundary test into a repeatable launch routine. It shows you what to inspect, what to ask your coding agent to change and what still needs a human decision.
What is inside
A working security routine, not a list of warnings.
A pre-launch checklist
A final pass across accounts, data access, secrets, APIs, uploads, payments, backups and recovery before real users arrive.
Copy-and-paste coding prompts
Concrete prompts you can give your coding agent to inspect and fix the parts that usually get skipped.
Supabase, Firebase and RLS patterns
Practical examples for ownership checks, row-level security and backend access, with the unsafe pattern beside the fix.
One month of Vibe App Scanner Go
Twenty full scans across up to three projects, included so you can run a first pass on the app before launch.
Vibe App Scanner Go requires a card to redeem and renews at $19 per month unless cancelled before renewal.
Five checks to start with
Test the rules users cannot see.
- 01Can one ordinary user read or change another user's records?
- 02Does the backend enforce the same ownership rules as the interface?
- 03Did a service-role key, private token or privileged endpoint reach the browser?
- 04Can file uploads, webhooks or payment actions be called without the right account?
- 05Has anyone restored the latest backup into an empty environment?
Built from the work
Written by someone who audits and ships these apps.
Jacob Perks works in cybersecurity, including at Field Effect Software. He built and sold SecurEcommerce and now builds Vibe App Scanner, Thunkle and Content Carousel. The launch kit condenses the repeatable parts of 12 application audits and reviews, backed by patterns across more than 1,200 scanner runs.
Common questions.
- Who is the launch kit for?
- It is for indie founders and developers shipping an AI-built web app with tools such as Lovable, Replit, Cursor, Claude Code or Bolt. The examples are especially useful for apps using Supabase or Firebase.
- Does this replace a professional security audit?
- No. It is a practical pre-launch guide and scanner bundle, not a penetration test, compliance assessment or guarantee that an app is secure. It helps you catch common mistakes and know what to test next.
- Is it useful if the app is already live?
- Yes. The same checks apply after launch. Run them before the next release, then repeat the two-account and recovery tests whenever access rules or critical workflows change.
- How does the included Vibe App Scanner month work?
- The bundle includes one month of Vibe App Scanner Go, with 20 full scans across up to three projects. Redemption requires a card and the plan renews at $19 per month unless you cancel before renewal.
- What do I receive after purchase?
- Pay $29 USD once through Stripe, then download the 27-page PDF from the confirmation page. The guide includes your scanner redemption instructions. Save your PDF: the private download link lasts seven days. If you close checkout or need another copy, email jacob@thunkle.ai from your purchase email address and we will verify your payment and resend it manually.
Security launch kit
Run the checks before real users do.
$29 USD. One-time purchase of the guide, prompts and checklist.