DuckAuditplaybooks
What to do. Step by step.
Each playbook is the full fix for one way vibe coded apps get burned: the story of how it happens, the exact steps, the code, and a prompt you can paste straight into your AI. Honest time estimates.
The 10 Minute Pre Launch Check
Run this once before you share the link. It catches the mistakes that make the news.
Keys Stay Home
Your API keys never meet the browser, never meet git, and get rotated the moment they slip.
Lock the Database Door
Row level security on every table, tested from the outside, so your anon key can shrug off strangers.
The Server Believes No One
Every route and server action verifies the caller itself, because client side checks are decoration.
Raise Your AI Right
Rules files and review prompts that turn your AI assistant from a happy path machine into a paranoid pair.
Trust No Package
Install discipline that survives hallucinated names, squatted packages, and malicious updates.
Stripe Without Leaks
Prices live on the server, webhooks prove themselves, and test keys stay test keys.
You Got Pwned. Now What.
A calm order of operations for the worst morning: contain, assess, patch, tell the truth.