https://quick-code-launch.lovable.app/assets/SecurityPage-B-MuqGcW.js

1import{j as e,H as N}from"./index-DrBPhjy5.js";import{L as w,o as m,F as v,c as h,k as S,p as u,E as x,Z as k}from"./Layout-LwDNXt6D.js";import{S as A}from"./SectionHeader-oIYtrJ-D.js";import{B as P}from"./badge-CMh-GqOk.js";import{C as a,a as r,b as n,d as c,c as o}from"./card-BCaF5CiV.js";import{A as C,a as I}from"./alert-DIYlhfDI.js";import{C as l}from"./circle-check-big-NDcTPFF2.js";import{E as p}from"./external-link-CLJaV4l5.js";const F=()=>{const g=[{icon:e.jsx(S,{className:"w-6 h-6"}),title:"Input Validation",description:"Always validate and sanitize user inputs to prevent injection attacks and data corruption.",practices:["Implement server-side validation for all inputs","Use parameterized queries for database operations","Sanitize data before processing or storage","Validate file uploads and restrict file types"]},{icon:e.jsx(u,{className:"w-6 h-6"}),title:"Authentication & Authorization",description:"Implement robust authentication mechanisms and proper access controls.",practices:["Use strong password policies and multi-factor authentication","Implement proper session management","Follow principle of least privilege for access control","Use secure authentication protocols (OAuth 2.0, OpenID Connect)"]},{icon:e.jsx(x,{className:"w-6 h-6"}),title:"Data Protection",description:"Protect sensitive data both in transit and at rest using encryption and secure protocols.",practices:["Encrypt sensitive data using industry-standard algorithms","Use HTTPS for all communications","Implement proper key management practices","Follow data minimization principles"]}],j=[{name:"SQL Injection",severity:"High",description:"Occurs when user input is directly concatenated into SQL queries without proper sanitization.",prevention:"Use parameterized queries and stored procedures. Validate all user inputs."},{name:"Cross-Site Scripting (XSS)",severity:"High",description:"Malicious scripts injected into web applications that execute in users' browsers.",prevention:"Sanitize output, use Content Security Policy, and validate all user inputs."},{name:"Insecure Authentication",severity:"High",description:"Weak authentication mechanisms that can be easily bypassed or broken.",prevention:"Implement strong password policies, use MFA, and secure session management."},{name:"Sensitive Data Exposure",severity:"High",description:"Unprotected sensitive data that can be accessed by unauthorized parties.",prevention:"Encrypt sensitive data, use secure protocols, and implement proper access controls."}],y=[{category:"Static Analysis",tools:[{name:"SonarQube",description:"Code quality and security analysis",url:"https://www.sonarqube.org/"},{name:"ESLint Security",description:"JavaScript security linting",url:"https://github.com/eslint-community/eslint-plugin-security"},{name:"Bandit",description:"Python security issues finder",url:"https://bandit.readthedocs.io/"}]},{category:"Dynamic Testing",tools:[{name:"OWASP ZAP",description:"Web application security scanner",url:"https://www.zaproxy.org/"},{name:"Burp Suite",description:"Web application security testing",url:"https://portswigger.net/burp"},{name:"Nmap",description:"Network discovery and security auditing",url:"https://nmap.org/"}]},{category:"Dependency Scanning",tools:[{name:"npm audit",description:"Node.js dependency vulnerability scanner",url:"https://docs.npmjs.com/cli/v10/commands/npm-audit"},{name:"Snyk",description:"Open source vulnerability management",url:"https://snyk.io/"},{name:"OWASP Dependency Check",description:"Software composition analysis",url:"https://owasp.org/www-project-dependency-check/"}]}],b=[{title:"Threat Modeling for New Features",prompt:"As you develop a new feature, list all possible ways a user could misuse or attack this part of your app. Use STRIDE or another threat modeling methodology to identify risks, and outline how you'll mitigate them."},{title:"Input Validation & Sanitization",prompt:'Prompt: "Explain how all user input in this route/component is validated and sanitized. Are there potential vectors for SQL injection, XSS, or other input vulnerabilities?"'},{title:"Secrets Management",prompt:"Describe where API keys, secrets, and credentials are stored. Are they accessible on the frontend? Suggest improvements for keeping secrets secure using environment variables or secret management platforms."},{title:"Role-Based Access Control Scenario",prompt:"Given the following user roles [admin, editor, viewer], describe how the app would restrict access to sensitive pages and actions. Suggest ways to test for privilege escalation."},{title:"Incident Response Drill",prompt:"Simulate: A suspected account takeover is detected. What immediate steps does your application take? Which logs are reviewed, and how do you communicate to affected users?"}],f=[{title:"Backend Lockdown",icon:e.jsx(u,{className:"w-5 h-5"}),facts:["Most AI-generated apps leave backends wide open to anyone who knows the endpoint URL","Default Supabase/Firebase settings often allow unrestricted access to sensitive data","Always implement Row Level Security (RLS) policies - deny all by default","Users should only access their own data, never others'","Check your database policies before going live"]},{title:"Frontend Trust Issues",icon:e.jsx(m,{className:"w-5 h-5"}),facts:["Never trust frontend validation alone - always validate on the backend","Frontend code can be inspected, modified, and replayed by anyone","Users can change their subscription status, credit limits, or permissions in browser dev tools","Critical actions like upgrades must be verified server-side","Assume every request could be malicious or modified"]},{title:"Common Vulnerabilities Found",icon:e.jsx(x,{className:"w-5 h-5"}),facts:["Public endpoints exposing full user lists and personal data","Open PUT/PATCH endpoints allowing data manipulation","Credit/subscription bypasses through client-side modifications","Premium feature access by changing local storage values","API endpoints accessible without proper authentication"]},{title:"Real-World Impact",icon:e.jsx(k,{className:"w-5 h-5"}),facts:["Users can burn through your API credits overnight if limits aren't enforced server-side","Data breaches can happen with basic browser inspection tools","Premium features can be accessed for free through simple DOM manipulation","Other users' data can be deleted or modified without authorization","Financial losses from API abuse can reach hundreds of dollars per incident"]}];return e.jsxs(w,{title:"Security for Vibe-Coded Apps",description:"Lock down AI-generated apps: auth, RLS, secrets, and the most common vulnerabilities to avoid.",canonicalUrl:"https://quick-code-launch.lovable.app/security",children:[e.jsx("h1",{className:"sr-only",children:"Security for Vibe-Coded Apps"}),e.jsxs(N,{children:[e.jsx("title",{children:"Security Best Practices – Vibe Coding"}),e.jsx("meta",{name:"description",content:"Essential security practices and guidelines for developing robust, secure software systems."}),e.jsx("meta",{property:"og:title",content:"Security Best Practices – Vibe Coding"}),e.jsx("meta",{property:"og:description",content:"Essential security practices and guidelines for developing robust, secure software systems."}),e.jsx("meta",{property:"og:image",content:"https://vibecoding.com/og-image.png"}),e.jsx("meta",{property:"og:url",content:"https://vibecoding.com/security"})]}),e.jsx("main",{className:"pt-10 pb-16",children:e.jsxs("div",{className:"container mx-auto px-2 sm:px-4 lg:px-8",children:[e.jsx(A,{subtitle:"Security Best Practices",title:"Building Secure Applications",description:"Essential security practices and guidelines for developing robust, secure software systems"}),e.jsxs("section",{className:"mb-16",children:[e.jsxs("div",{className:"flex items-center space-x-3 mb-8",children:[e.jsx(m,{className:"w-8 h-8 text-red-500"}),e.jsx("h2",{className:"text-2xl font-bold text-red-600",children:"Qu

1ick Security Facts for AI-Generated Apps"})]}),e.jsxs(C,{className:"mb-8 border-red-200 bg-red-50",children:[e.jsx(m,{className:"h-4 w-4 text-red-500"}),e.jsxs(I,{className:"text-red-700",children:[e.jsx("strong",{children:"Critical Warning:"})," Many AI-generated applications have serious security vulnerabilities. These issues have been found in real-world apps built with tools like Lovable, Bolt, and similar platforms."]})]}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-6",children:f.map((s,t)=>e.jsxs(a,{className:"border-red-100",children:[e.jsx(r,{children:e.jsxs("div",{className:"flex items-center space-x-3",children:[e.jsx("div",{className:"p-2 bg-red-100 rounded-lg text-red-600",children:s.icon}),e.jsx(n,{className:"text-lg text-red-700",children:s.title})]})}),e.jsx(c,{children:e.jsx("ul",{className:"space-y-2",children:s.facts.map((i,d)=>e.jsxs("li",{className:"flex items-start space-x-2",children:[e.jsx(m,{className:"w-4 h-4 text-red-500 mt-0.5 flex-shrink-0"}),e.jsx("span",{className:"text-sm text-gray-700",children:i})]},d))})})]},t))}),e.jsxs("div",{className:"mt-6 p-4 bg-blue-50 border border-blue-200 rounded-lg",children:[e.jsx("h4",{className:"font-semibold text-blue-800 mb-2",children:"Take Action Now:"}),e.jsx("p",{className:"text-blue-700 text-sm mb-3",children:"Ask your AI coding assistant to generate a security audit tasklist for your specific project. Review and fix all identified issues before deploying to production."}),e.jsxs("div",{className:"bg-blue-800 text-white p-3 rounded text-sm",children:[e.jsx("strong",{children:"Example Prompt:"}),' "Generate a comprehensive security audit checklist for my [describe your app] built with Supabase. Include RLS policies, authentication flows, and API endpoint security."']})]})]}),e.jsxs("section",{className:"mb-16",children:[e.jsx("h2",{className:"text-2xl font-bold mb-8",children:"Core Security Principles"}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-3 gap-8",children:g.map((s,t)=>e.jsxs(a,{className:"h-full",children:[e.jsxs(r,{children:[e.jsxs("div",{className:"flex items-center space-x-3 mb-2",children:[e.jsx("div",{className:"p-2 bg-primary/10 rounded-lg text-primary",children:s.icon}),e.jsx(n,{className:"text-lg",children:s.title})]}),e.jsx(o,{children:s.description})]}),e.jsx(c,{children:e.jsx("ul",{className:"space-y-2",children:s.practices.map((i,d)=>e.jsxs("li",{className:"flex items-start space-x-2",children:[e.jsx(l,{className:"w-4 h-4 text-green-500 mt-0.5 flex-shrink-0"}),e.jsx("span",{className:"text-sm",children:i})]},d))})})]},t))})]}),e.jsxs("section",{className:"mb-16",children:[e.jsx("h2",{className:"text-2xl font-bold mb-8",children:"Common Vulnerabilities"}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-6",children:j.map((s,t)=>e.jsxs(a,{children:[e.jsxs(r,{children:[e.jsxs("div",{className:"flex items-center justify-between",children:[e.jsx(n,{className:"text-lg",children:s.name}),e.jsx(P,{variant:s.severity==="High"?"destructive":"secondary",className:s.severity==="High"?"bg-red-100 text-red-800":"",children:s.severity})]}),e.jsx(o,{children:s.description})]}),e.jsx(c,{children:e.jsxs("div",{className:"bg-green-50 p-3 rounded-lg",children:[e.jsx("h4",{className:"font-medium text-green-800 mb-1",children:"Prevention:"}),e.jsx("p",{className:"text-sm text-green-700",children:s.prevention})]})})]},t))})]}),e.jsxs("section",{className:"mb-16",children:[e.jsx("h2",{className:"text-2xl font-bold mb-8",children:"Security Tools & Technologies"}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-3 gap-8",children:y.map((s,t)=>e.jsxs(a,{children:[e.jsx(r,{children:e.jsx(n,{className:"text-lg",children:s.category})}),e.jsx(c,{children:e.jsx("div",{className:"space-y-4",children:s.tools.map((i,d)=>e.jsxs("div",{className:"border-b border-gray-100 pb-3 last:border-b-0",children:[e.jsx("h4",{className:"font-medium",children:i.url?e.jsxs("a",{href:i.url,target:"_blank",rel:"noopener noreferrer",className:"text-primary hover:underline inline-flex items-center",children:[i.name,e.jsx(p,{className:"w-3 h-3 ml-1 inline-block"})]}):i.name}),e.jsx("p",{className:"text-sm text-gray-600",children:i.description})]},d))})})]},t))})]}),e.jsxs("section",{className:"mb-16",children:[e.jsx("h2",{className:"text-2xl font-bold mb-6 text-cyber-blue",children:"Example Security Prompts & Guidance"}),e.jsx("p",{className:"mb-6 text-gray-700",children:"Use these prompts and best practices to reinforce security-focused thinking while building and maintaining your Vibe Coding applications."}),e.jsx("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-6",children:b.map((s,t)=>e.jsxs(a,{className:"mb-3",children:[e.jsx(r,{children:e.jsx(n,{className:"text-base font-semibold text-primary",children:s.title})}),e.jsx(c,{children:e.jsx("pre",{className:"bg-gray-800 text-white p-3 rounded-lg text-sm overflow-x-auto",children:s.prompt})})]},t))}),e.jsxs("div",{className:"mt-6 text-sm text-cyber-pink",children:[e.jsx("span",{className:"font-bold",children:"Tip:"})," Regularly prompt your team or AI coding tools to assess for threats, security misconfigurations, and review any third-party integrations for vulnerabilities."]})]}),e.jsxs("section",{className:"mb-16",children:[e.jsx("h2",{className:"text-2xl font-bold mb-8",children:"Security Implementation Checklist"}),e.jsxs(a,{children:[e.jsxs(r,{children:[e.jsxs(n,{className:"flex items-center space-x-2",children:[e.jsx(v,{className:"w-5 h-5"}),e.jsx("span",{children:"Pre-Deployment Security Checklist"})]}),e.jsx(o,{children:"Essential security checks to perform before deploying your application"})]}),e.jsx(c,{children:e.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-2 gap-6",children:[e.jsxs("div",{children:[e.jsx("h4",{className:"font-medium mb-3",children:"Authentication & Authorization"}),e.jsxs("ul",{className:"space-y-2 text-sm",children:[e.jsxs("li",{className:"flex items-center space-x-2",children:[e.jsx(l,{className:"w-4 h-4 text-green-500"}),e.jsx("span",{children:"Strong password policies implemented"})]}),e.jsxs("li",{className:"flex items-center space-x-2",children:[e.jsx(l,{className:"w-4 h-4 text-green-500"}),e.jsx("span",{children:"Multi-factor authentication configured"})]}),e.jsxs("li",{className:"flex items-center space-x-2",children:[e.jsx(l,{className:"w-4 h-4 text-green-500"}),e.jsx("span",{children:"Session management secure"})]}),e.jsxs("li",{className:"flex items-center space-x-2",children:[e.jsx(l,{className:"w-4 h-4 text-green-500"}),e.jsx("span",{children:"Access controls properly configured"})]})]})]}),e.jsxs("div",{children:[e.jsx("h4",{className:"font-medium mb-3",children:"Data Protection"}),e.jsxs("ul",{className:"space-y-2 text-sm",children:[e.jsxs("li",{className:"flex items-center space-x-2",children:[e.jsx(l,{className:"w-4 h-4 text-green-500"}),e.jsx("span",{children:"Sensitive data encrypted"})]}),e.jsxs("li",{className:"flex items-center space-x-2",children:[e.jsx(l,{className:"w-4 h-4 text-green-500"}),e.jsx("span",{children:"HTTPS enforced"})]}),e.jsxs("li",{className:"flex items-center space-x-2",children:[e.jsx(l,{className:"w-4 h-4 text-green-500"}),e.jsx("span",{children:"Input validation implemented"})]}),e.jsxs("li",{className:"flex items-center space-x-2",children:[e.jsx(l,{className:"w-4 h-4 text-green-500"}),e.jsx("span",{children:"Error handling secure"})]})]})]})]})})]})]}),e.jsxs("section",{children:[e.jsx("h2",{className:"text-2xl font-bold mb-8 text-cyber-purple",children:"Additional Resources"}),e.jsxs("div",{className:"grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6",children:[e.jsxs(a,{children:[e.jsxs(r,{children:[e.jsx(n,{className:"text-lg",children:"OWASP Guidelines"}),e.jsx(o,{children:"Comprehensive web application security guidance"})]}),e.jsx(c,{children:e.jsx("a",{href:"https://owasp.org/www-project-top-ten/",target:"_blank",rel:"noopener noreferrer",children:e.jsxs(h,{variant:"outline",className:"w-full",children:[e.jsx(p,{className:"w-4 h-4 mr-2"}),"Visit OWASP"]})})})]}),e.jsxs(a,{children:[e.jsxs(r,{children:[e.jsx(n,{className:"text-lg",children:"Security Training"}),e.jsx(o,{children:"Learn secure coding practices and techniques"})]}),e.jsx(c,{children:e.jsx("a",{href:"https://www.cybrary.it/catalog/cyber-security/secure-coding/",target:"_blank",rel:"noopener noreferrer",children:e.jsxs(h,{variant:"outline",className:"w-full",children:[e.jsx(p,{className:"w-4 h-4 mr-2"}),"Start Training"]})})})]}),e.jsxs(a,{children:[e.jsxs(r,{children:[e.jsx(n,{className:"text-lg",children:"Vulnerability Database"}),e.jsx(o,{children:"Stay updated on latest security vulnerabilities"})]}),e.jsx(c,{children:e.jsx("a",{href:"https://cve.mitre.org/",target:"_blank",rel:"noopener noreferrer",children:e.jsxs(h,{variant:"outline",className:"w-full",children:[e.jsx(p,{className:"w-4 h-4 mr-2"}),"Browse CVEs"]})})})]})]})]})]})})]})};export{F as default};