A Client Vibe-Coded Four Production Apps. We Ran a 30-Point Security Check on What They Built.

A client came to us after vibe-coding four production applications with AI. The apps worked. Users were onboarded. Revenue was flowing. But the founder had a nagging question: "We built all of this with AI code generation. How do we know it's actually secure?"

Good question. So we built a structured 30-point security posture checklist and ran it across all four systems. Not a penetration test. Not a compliance checkbox exercise. Something more practical: a systematic evaluation of the security fundamentals that AI-generated code often gets wrong.

The results were exactly what you'd expect from code that shipped fast and never got a security review.

Out of 120 total evaluations, 14 were outright failures, 16 were partial implementations, and 61 were clean passes. The rest didn't apply to a given system. The failures weren't in obscure edge cases. They were in fundamentals: credential rotation, database access controls, rate limiting, and backup verification.

Why a Posture Check, Not a Pentest

Penetration testing tells you what an attacker can exploit right now. Valuable, but expensive, slow, and a snapshot in time. A security posture check asks a different question: are the foundations solid? It's the difference between testing whether someone can break into your house and checking whether you remembered to install locks on all the doors.

We designed our checklist around eight categories that collectively cover the full attack surface of a modern web application:

Each check is rated by severity: critical, high, medium, or low. Every system gets a verdict for each point: pass, partial, fail, or not applicable. No ambiguity.

"Most security breaches don't exploit sophisticated zero-days. They walk through doors that were never locked in the first place."

What We Found: The Uncomfortable Patterns

The failures weren't random. They clustered around a handful of themes that, frankly, most teams will recognize in their own infrastructure.

The Good News

How We Did It: AI Agents as Security Evaluators

Here's the part that surprised us. We didn't run this checklist manually. We assigned it to our AI agents, each evaluating a different system. Each agent reviewed the actual codebase, checked real configuration files, queried live database schemas, and produced findings with specific evidence.

The agent that flagged the database access control gaps did so by querying the database for which tables had Row-Level Security enabled. Not by reading documentation that claimed everything was locked down. The agent that found the credential rotation debt did so by checking actual rotation timestamps, not by trusting a policy document that said "we rotate every 90 days."

"Documentation says what should be true. Code says what is true. A good security evaluation verifies the code, not the docs."

This isn't a replacement for professional security auditing. But as a recurring hygiene practice, AI-assisted security evaluation catches the kind of drift that accumulates between formal audits. Configuration changes, new endpoints without rate limits, dependencies that age past their CVE window. The kind of slow erosion that nobody notices until something breaks.

The Remediation Playbook

After running the evaluation, we prioritized remediation by severity and effort. Critical failures that were easy to fix went first. A ten-minute configuration change that closes a critical gap beats a week-long refactor every time.

1. Default-deny database access. Enable Row-Level Security on every table, including internal ones. Write explicit policies for each access pattern. This is the highest-impact single change.
2. Enforce credential rotation. Automated alerts when any credential passes 90 days without rotation. Make it impossible to ignore.
3. Rate limit internal APIs. The cost of adding rate limiting is negligible. The cost of not having it is unpredictable.
4. Test backup restoration quarterly. Schedule it. Document it. Time it. If recovery takes longer than your tolerance, that's a problem to solve now, not during an incident.

Within days of delivering the report, the client's teams had already moved from 17 failures to 14, and from 56 passes to 61. Dependency vulnerabilities were patched. Unprotected endpoints got auth middleware. Dead webhook endpoints were removed. The improvements came fast because the findings were specific enough to act on immediately.

Why This Matters for Your Business

Security posture isn't a binary. You're not "secure" or "insecure." You have a score across a spectrum of controls, and that score changes every time you ship code, add a dependency, or create a new API key. Most organizations have no idea what their score is. They assume it's fine because nothing has gone wrong yet.

A structured posture check takes the vague anxiety of "are we secure?" and turns it into specific, prioritized findings. It's the difference between hoping your infrastructure is sound and knowing where it's strong, where it's weak, and what to fix first.

We now recommend running this checklist quarterly. The first run is always the most revealing. After that, it becomes a maintenance practice that keeps drift from becoming a crisis.

"The first time you run a real security evaluation on your own systems, you find things you wish you'd caught months ago. The second time, you're just keeping score."