Free browser tools

Four security helpers for your vibe app

Everything stays in your browser. Inputs are never transmitted or logged.

1. Vibe app launch checklist

Enforce authentication on the server
Test tenant isolation with two accounts
Remove secrets from frontend and Git history
Review RLS/Firestore rules
Verify webhook signatures
Rate-limit login and password reset
Enable security headers and HTTPS
Test backup and rollback

0/8 done

2. Supabase RLS helper

○ 0 table(s) enabling RLS
○ 0 policies detected
○ User binding detected
○ WITH CHECK
✓ 0 open TRUE policies

3. Key: public or secret?

Not identified with confidence

When in doubt, keep it server-side.

Check provider documentation and minimise permissions.

4. Security header generator

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Content-Security-Policy",
          "value": "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
        },
        {
          "key": "Strict-Transport-Security",
          "value": "max-age=31536000; includeSubDomains"
        },
        {
          "key": "X-Content-Type-Options",
          "value": "nosniff"
        },
        {
          "key": "Referrer-Policy",
          "value": "strict-origin-when-cross-origin"
        },
        {
          "key": "Permissions-Policy",
          "value": "camera=(), microphone=(), geolocation=()"
        }
      ]
    }
  ]
}