Web App Security Audit Checklist: 25 Checks Before Launch

Quick answer: A web app security audit requires checking 25 critical points across authentication, authorization, and infrastructure. SimplyScan's data shows 30% of AI-built apps have high-severity risks like exposed keys or missing RLS. Use this checklist to secure your vibe-coded apps before launch and ensure production-grade safety for your users.

By Gabriel CA · Kraftwire Software

To perform a web app security audit, you must systematically verify seven domains: authentication, authorization (specifically RLS and IDOR), data protection, API integrity, infrastructure configuration, dependency health, and logging. A production-ready audit requires checking for exposed API keys, validating server-side permissions, and ensuring security headers like CSP and HSTS are active.

AI Security App Review: The Reality of Vibe-Coded Software

An ai security app review reveals a widening gap between development speed and safety. While tools like Lovable, Bolt.new, and Cursor allow developers to build full-stack applications in minutes, they often bypass traditional security guardrails.

The rise of "vibe coding" · where developers describe features and AI generates the implementation · has created a unique set of risks. AI models are optimized for functionality and "making it work," not necessarily for making it secure. For AI-built apps, this risk is compounded by the fact that the developer may not fully understand the underlying code the AI has produced.

Why You Need a Security Audit Checklist for AI Apps

Most security breaches in the modern era do not stem from sophisticated zero-day exploits. Instead, they exploit basic misconfigurations that AI models frequently overlook or omit for brevity.

This suggests that while the code might "run," the structural decisions · such as how data is isolated between users · are often flawed. A checklist forces a manual or automated "sanity check" on the generated code, ensuring that the speed of AI development doesn't lead to a catastrophic data leak. According to AppSec Santa, teams scoring low on security assessments should prioritize Code Security and Authentication as their first line of defense.

1. How Do You Audit Authentication?

Authentication is the front door of your application. If it is weak, the rest of your security posture is irrelevant. AI tools often generate "happy path" login flows that lack defensive depth, such as failing to implement rate limiting or using insecure session storage.

Critical Authentication Checks

• Password Policy: Are you enforcing a minimum length of at least 12 characters? AI-generated forms often default to 8 characters, which is insufficient against modern brute-force attacks.
• Session Management: Are session tokens rotated after login? Are you using HttpOnly and Secure flags for cookies to prevent XSS-based token theft?
• Multi-Factor Authentication (MFA): Is MFA required for admin accounts? For AI-built apps using Supabase or Firebase, ensure MFA is not just enabled in the dashboard but enforced in the application logic.
• Brute Force Protection: AI-generated backends often miss rate limiting. You must track failed attempts per IP and per account to prevent credential stuffing.

2. How Do You Audit Authorization?

Authentication verifies identity; authorization controls access. This is the most common failure point in vibe-coded apps. When an AI builds a dashboard, it might correctly verify you are logged in, but fail to check if you are authorized to view the specific data requested.

Critical Authorization Checks

• Row-Level Security (RLS): If using Supabase or Postgres, is RLS enabled? Without it, any user with an anon key can read your entire database. Read our RLS policies guide for implementation details.
• IDOR Protection: Can a user access another user's data by changing a UUID or integer ID in the URL? Test every API endpoint by attempting to access a resource ID belonging to a different account.
• Server-Side Validation: Never trust the client-side state. If a user is marked as an "admin" in your React or Vue state, the server-side API must still verify that role in the database before executing any privileged action.

3. How Do You Audit Data Protection?

Data breaches are expensive and destroy user trust. Protecting data at rest and in transit is a non-negotiable requirement for any app review. A structured audit catches expired certificates and misconfigured headers before attackers can exploit them.

Critical Data Protection Checks

• Encryption in Transit: Is HTTPS enforced? Use our SSL checker to verify your certificate chain and ensure you aren't using deprecated TLS versions.
• HSTS Headers: Are you using Strict-Transport-Security to force browsers to use HTTPS? This prevents man-in-the-middle attacks during the initial connection.
• Encryption at Rest: Sensitive fields like PII (Personally Identifiable Information) or third-party API keys should be encrypted before they are stored in your database.
• Data Minimization: Are you collecting data you don't need? In the AI era, "hoarding" data increases your liability if the AI-generated logic has a leak.

4. How Do You Audit API Security?

APIs are the primary attack surface for AI-built apps. Because tools like v0 or Bolt.new often generate API routes quickly to satisfy a UI requirement, they may skip rigorous input validation.

Critical API Checks

• Input Validation: Use a schema library like Zod or Joi to validate every incoming request. If an API expects a number, ensure it doesn't process a string or a nested object that could trigger a code injection.
• Rate Limiting: Implement global and per-route rate limits to prevent denial-of-service (DoS) attacks and automated scraping.
• Generic Error Messages: Ensure your API does not return stack traces, database schema names, or environment details to the frontend.

5. How Do You Audit Your Infrastructure?

Your code might be secure, but a misconfigured environment can expose everything. SimplyScan's security scanner frequently finds secrets leaked in client-side bundles because the AI agent placed them in the wrong file.

Critical Infrastructure Checks

• Environment Variables: Are secrets like STRIPE_SECRET_KEY or OPENAI_API_KEY strictly on the server? Use our secret scanner to check your public-facing site for leaked .env values.
• CORS Configuration: Is your CORS policy restricted to your specific domain? Avoid Access-Control-Allow-Origin: * in production environments.
• Security Headers: Check for Content-Security-Policy (CSP) to prevent XSS. You can evaluate your policy with our CSP evaluator.
• Email Security: Ensure your domain has valid SPF, DKIM, and DMARC records to prevent your transactional emails from being marked as spam or used for phishing.

6. How Do You Audit Dependencies?

Modern apps rely on hundreds of npm packages. AI tools often suggest popular but outdated or vulnerable libraries. In some cases, AI has even been known to suggest "hallucinated" package names that do not exist, opening the door for typosquatting attacks.

Critical Dependency Checks

• Automated Audits: Run npm audit or yarn audit as part of your CI/CD pipeline. However, remember that these only catch known vulnerabilities in libraries, not flaws in your own code.
• Unmaintained Packages: Check if your core dependencies have been updated in the last 12 months. Abandoned packages are a major security risk.
• License Compliance: Ensure the libraries suggested by the AI don't have restrictive licenses that conflict with your business model.

7. How Do You Audit Logging and Monitoring?

If you cannot detect an attack, you cannot stop it. AI-built apps often neglect observability until a breach occurs. Monitoring is not just for uptime; it is a critical security component.

Critical Monitoring Checks

• Audit Logs: Are you logging every login, password change, and permission update? These logs should be immutable and stored separately from the main database.
• Alerting: Do you get a notification when a high number of 401 (Unauthorized) or 403 (Forbidden) errors occur? This is often the first sign of a bot-driven attack.
• Uptime Monitoring: Use uptime monitoring to ensure your security services (like auth providers or WAFs) are actually reachable and functioning.

The Complete 25-Point Security Audit Checklist

Authentication & Identity

• Password length enforced at >= 12 characters.
• Passwords checked against known breach lists (HIBP).
• MFA enforced for all administrative and high-privilege roles.
• Session tokens use HttpOnly, Secure, and SameSite=Lax flags.
• Automatic session timeout implemented after 30 minutes of inactivity.
• Rate limiting active on all login, signup, and password reset endpoints.

Authorization & Access Control

• Row-Level Security (RLS) enabled and tested on all database tables.
• No Insecure Direct Object References (IDOR) in API routes or URLs.
• Role-based access control (RBAC) logic verified on the server side.
• Public API keys (like Supabase anon) have strictly restricted permissions.

Data Security

• Full-site HTTPS with a valid, non-expired SSL certificate.
• HSTS (Strict-Transport-Security) header implemented with includeSubDomains.
• Sensitive PII and secrets encrypted at rest using AES-256 or similar.
• Database backups are encrypted, tested, and stored off-site.

API & Input Integrity

• Strict schema validation (e.g., Zod) on all incoming API payloads.
• Protection against NoSQL/SQL injection and XSS (Cross-Site Scripting).
• API error messages are generic and do not leak system or stack info.
• Cross-Origin Resource Sharing (CORS) restricted to trusted production origins.

Infrastructure & Deployment

• No secrets (API keys, DB strings) present in the frontend JavaScript bundles.
• Security headers (CSP, X-Frame-Options, X-Content-Type-Options) are present.
• DNSSEC and CAA records configured for the root domain.
• SPF, DKIM, and DMARC records are valid and in "reject" or "quarantine" mode.

Maintenance & Monitoring

• npm audit shows zero high or critical vulnerabilities in the dependency tree.
• Centralized logging active for all authentication and authorization failures.
• Real-time alerts configured for unusual traffic spikes or mass data exports.

How Often Should You Perform an AI Security App Review?

Security is a moving target, especially when using AI agents that can modify your codebase autonomously. An audit performed today does not cover the code your AI agent generates tomorrow. We recommend a tiered approach:

• Continuous Scanning: Use an automated tool like SimplyScan for every deployment to catch regressions.
• Monthly Deep Dives: Manually review authorization logic and RLS policies, as these are the most likely to break during rapid iteration.
• Pre-Launch Audit: Always run a full 25-point check before moving from a staging environment to production.

A slow app is often an unoptimized app, and unoptimized code frequently contains the types of shortcuts that lead to security vulnerabilities.

Related Free Tools for Your Audit

Speed up your audit with these instant diagnostic tools from SimplyScan:

• Security Headers Scanner · Check your CSP, HSTS, and X-Frame-Options status.
• Email Security Tester · Verify your SPF, DKIM, and DMARC records for domain health.
• Exposed Files Finder · Ensure .env, .git, or docker-compose.yml files aren't public.
• JWT Debugger · Inspect your session tokens for weak signing algorithms or sensitive data.
• CORS Tester · Verify that your API isn't open to unauthorized domains.

Browse all 60 free tools to complete your comprehensive security review.

FAQ

[{"a":"An AI security app review is a specialized audit of applications built using AI coding tools like Cursor, Lovable, or Windsurf. It focuses on risks unique to AI generation, such as 'hallucinated' dependencies, disabled database security (like missing RLS), and exposed API keys. While npm audit catches vulnerable third-party packages, it cannot detect architectural flaws like missing Row-Level Security (RLS) or exposed environment variables. In our review of 170 apps, many passed dependency checks but failed on infrastructure and authorization, which npm audit does not monitor.","q":"Is npm audit enough for a full security review?"},{"a":"IDOR (Insecure Direct Object Reference) occurs when an app exposes a direct link to an internal object, like a database ID, without checking permissions. An attacker can change the ID in the URL to view other users' private data. This is a top risk in AI-generated backends where authorization logic is often skipped.","q":"Why is IDOR a major risk in AI-built apps?"},{"a":"Yes. Attackers use automated bots to scan new deployments for common vulnerabilities like exposed .env files or open Firebase instances. However, they cannot fully understand your specific business logic. The best approach is to use automated tools for continuous monitoring and a manual checklist for complex authorization rules.","q":"Can automated tools replace a manual security audit?"}]