Security
Secure by default. Not as an add-on.
Vibe-coded apps usually fail in the same ten places. Every project we touch, whether we merge it or build it, passes all ten before it goes live.
The Cosmerg Security Standard
Ten checks before liftoff.
This is the minimum for every launch. A Scan shows you which ones your app fails today; Launch and Harden fix them.
- pre-launch / security10 checks
- 01Go
Secrets kept server-side and rotated after handover
Keys in the browser bundle can be copied by anyone who opens dev tools.
- 02Go
Authorization and row-level security on every table
Being signed in must never mean being able to read someone else's data.
- 03Go
Auth hardened: sessions, password reset, OAuth callbacks
Account takeover usually happens through the flows nobody tested.
- 04Go
Input validated on the server, never only in the browser
Browser checks are for convenience. Attackers skip the browser.
- 05Go
Rate limits on auth, AI, and paid API routes
Stops brute-force logins and bots running up your AI and API bills.
- 06Go
Payment webhooks verified and idempotent
Forged or repeated webhooks can grant free access or double-charge customers.
- 07Go
Dependencies scanned, known vulnerabilities patched
Most apps ship hundreds of packages. Some of them will have known holes.
- 08Go
Security headers and HTTPS everywhere
Cheap browser-level protection against clickjacking, sniffing, and downgrade attacks.
- 09Go
Backups enabled and a restore tested
A backup you've never restored is a hope, not a backup.
- 10Go
Errors and logs captured without leaking user data
You can't fix what you can't see, and logs must not become a data leak.
What we find
The holes AI tools leave behind.
AI assistants write code that works for the person testing it. They rarely think about the person attacking it.
Keys in the browserCritical
Service keys and API secrets shipped inside the JavaScript bundle.
Row-level security offCritical
Any signed-in user can read or edit every other user's data.
Payments out of syncHigh
Webhooks unverified or unhandled, so subscriptions drift from reality.
Runaway billsHigh
No rate limits on AI and API calls. One bot can burn a month's budget.
No safety netMedium
No tests, no CI, no staging. Every change is deployed straight to users.
Flying blindMedium
No error tracking, logs, or backups. Outages are reported by customers.
In every phase
Security isn't a step. It's in all of them.
Scan / Map
Threat review of your app or design: what's exposed, who could abuse it, what it would cost.
Merge / Build
Fixes and new code written to the Security Standard and reviewed by a second engineer.
Launch
Pre-launch checklist run against production: keys rotated, headers on, backups restored.
Orbit
Dependency patches, alerting, and a monthly health report that includes security.
Your code and access
How we handle what you trust us with.
You're giving us the keys to your product. These are the rules we follow with them.
NDA on request
Happy to sign yours or ours before you share anything.
Least-privilege access
We ask for the narrowest access that gets the job done, scoped per project and per person.
No secrets over chat or email
Credentials go through a password manager or your platform's own invite flow.
Your accounts, your data
Production runs in your cloud and database accounts. We never move data to ours.
Everything through pull requests
Every change is reviewed and recorded in your repo's history. No silent edits in production.
Clean exit
When the work ends we remove our access and help you rotate every key we touched.
FAQ
Security questions.
Is a Scan the same as a penetration test?
No. A Scan is a code, configuration, and infrastructure review focused on the issues we see most in vibe-coded apps. If you need a formal pen test for a customer or investor, we'll help you prepare for it and recommend a specialist.
Do you need access to my production data?
Rarely. Most work happens on code and configuration. When we do need production access, it's read-only by default and removed when the task is done.
Can you guarantee my app is secure?
Nobody honestly can. What we guarantee is that your app meets the Cosmerg Security Standard at launch, and that you know exactly what was checked and what wasn't.
What if you find something serious during the work?
We tell you the same day, explain the risk in plain language, and propose a fix before doing anything else.
How many of the ten does your app pass?
Send us your live app and we'll tell you, free, within two business days.