- Builds
- Pre-launch security pass for vibe-coded apps
Pre-launch security pass for vibe-coded apps
Before you launch a vibe-coded Supabase + Vercel app: turn on RLS checks, secret/dependency scanning, hosting hygiene, and optional AI code review — with a clear £0–£22.47/mo add-on bill.
For: vibe-coder about to launch a Supabase + Vercel app
The stack
DATAAUTHSupabase Security AdvisorFlags tables with RLS disabledFree / Pro £18.72
- Layer
- DB / RLS check
- Plan
- Free (Advisor) · Pro for leaked-password protection
- What it does here
- Flags tables with RLS disabled
- Note
- Pro already counted if you follow the SaaS build; leaked-password protection needs Pro
OPSGitHubDependabot + secret scanningFree
- Layer
- Secrets / deps
- Plan
- Free
- What it does here
- Dependabot + secret scanning
- Note
- Secret scanning + push protection free on public repos; private Secret Protection price not found
HOSTVercelSecret env vars, Deployment Protection, pin Next.jsFree add-on
- Layer
- Hosting hygiene
- Plan
- Included in host plan
- What it does here
- Secret env vars, Deployment Protection, pin Next.js
- Note
- Pin Next.js ≥16.4.1 / 15.5.28 (Stackguide security research, secondary)
OPSCodeRabbitSecurity-oriented review (static analysis, secrets, deps)Free / £22.47
- Layer
- AI code review
- Plan
- Free (public) · Essentials
- What it does here
- Security-oriented review (static analysis, secrets, deps)
- Note
- $30/dev/mo → £22.47; annual $24 → £17.97
Steps
RLS pass
Supabase Dashboard → Advisors; fix any table with RLS off; review policies.
Done when Advisor shows no open RLS findings you accept.
Auth hardening
Enable leaked-password protection if on Supabase Pro; review OAuth/redirect allowlists.
Done when settings match your launch threat model.
Secrets & deps
Dependabot on; secret scanning + push protection (public repos free).
Done when CI opens dependency PRs and pushes with secrets are blocked where available.
Vercel hygiene
Store secrets with Vercel's Secret environment variable type; Deployment Protection on preview; pin patched Next.js.
Done when env isn’t in client bundles and deploys use the pinned version.
Optional CodeRabbit
Enable on the repo (Free public / Essentials private).
Done when a PR gets a security-oriented review comment.
Smoke
Hit a deliberately weak demo table/route once; confirm Advisor or review catches it.
Done when you have a before/after note.
Watch out for
- Supabase Pro (£18.72) is required for leaked-password protection — don’t assume Free covers it.
- GitHub Secret Protection for private repos: price not found on the pricing page this pass.
- CodeRabbit Free is for public repos; private needs Essentials (£22.47/dev/mo monthly).
- Deep Scan one-off: variable / not found — not in totals.
- Some RLS guidance we found is from a secondary blog. Prefer Supabase’s own secure-data docs as the primary source.
What it costs each month
Costs on top of the app stack (Supabase/Vercel already paid separately).
| Stage | Platform (no Lovable) | Stripe fees | Total | + Lovable Pro |
|---|---|---|---|---|
| (a) Public repo, free tiers | £0.00 | £0.00 | £0.00 | £0.00 |
| (b) Private repo, 1 dev CodeRabbit Essentials | £22.47 | £0.00 | £22.47 | £0.00 |
If your app is not already on Supabase Pro, add Supabase Pro £18.72, which brings (b) to £41.19/mo (source: Supabase pricing, checked 2026-10-16).
Lovable is not part of this build (+ column £0). Stripe £0 (no payments tool here).
Platform at (a) = GitHub Free + CodeRabbit Free (public) + Advisor on existing Supabase (= £0.00 add-on).
Platform at (b) = CodeRabbit Essentials £22.47 ($30 × 0.7489). If you also need Supabase Pro solely for leaked-password protection and aren’t already on Pro, add £18.72 (already in SaaS build stage totals when applicable).
Excluded: VAT, Deep Scan (price not found), private-repo GitHub Secret Protection (price not found), usage overages.
What the totals leave out
- £0 path exists for public repos on free tiers (desk-costed).
- Private repos usually mean CodeRabbit Essentials (£22.47/mo for 1 dev monthly).
- App stack (Supabase/Vercel) is not double-counted in the stage totals above.
Disclosures
No sponsored or affiliate placements.
Sources
FX: 1 USD = 0.7489 GBP (Bank of England reference rate, 16 Oct 2026). Source: https://www.bankofengland.co.uk/boeapps/database/_iadb-fromshowcolumns.asp?csv.x=yes&Datefrom=12/Oct/2026&Dateto=20/Oct/2026&SeriesCodes=XUDLUSS&CSVF=TN&UsingCodes=Y&VPD=Y&VFD=N (checked 2026-10-23).
Source: Stackguide desk research, checked 16 Oct 2026, using the vendor pages below. Security pointers: Stackguide security research (secondary), checked 16 Oct 2026. Confidence: desk-costed.
| Vendor / doc | URL |
|---|---|
| CodeRabbit | https://www.coderabbit.ai/pricing |
| GitHub | https://github.com/pricing |
| Supabase pricing | https://supabase.com/pricing |
| Supabase secure data | https://supabase.com/docs/guides/database/secure-data |
| FX | https://www.bankofengland.co.uk/boeapps/database/_iadb-fromshowcolumns.asp?csv.x=yes&Datefrom=12/Oct/2026&Dateto=20/Oct/2026&SeriesCodes=XUDLUSS&CSVF=TN&UsingCodes=Y&VPD=Y&VFD=N |
Change log
| Date | Change | Source |
|---|---|---|
| 2026-10-16 | First desk-costed Pre-launch security pass build | Stackguide desk research |
| 2026-10-16 | Added £41.19 note for apps without Supabase Pro | Stackguide desk research |
| 2026-10-23 | USD prices re-converted at the Bank of England reference rate, 1 USD = 0.7489 GBP (16 Oct 2026), the one rate used site-wide (was 0.7535, exchangerates.org.uk 15 Oct 2026 close); £ figures and totals re-derived | Bank of England series XUDLUSS, checked 2026-10-23 |