Top 3 security issues in vibe coded apps

I've done security audits of numerous vibe coded apps and here are the 3 most common security issues I've found in many of them:

1. Database tables with no Row-Level Security (RLS)
The flagship vibe-coded bug. The public "anon" key sits in every visitor's browser, and without RLS anyone can hit your database's REST API directly and read tables — no login.

2. Missing security headers (nearly universal)
Almost every single site was missing most or all of: Content-Security-Policy, X-Frame-Options (clickjacking), HSTS (forces HTTPS), X-Content-Type-Options, Referrer-Policy, Permissions-Policy.

3. Email spoofing — missing SPF / DMARC (or DMARC set to p=none**)**
Extremely common. People build the app but never touch DNS.

If you're vibe coding something right now you probably want to double-check that you have these right. Drop your SaaS URL and I'll do a free security audit to check for these issues and other common ones.