Security checklist before delivering to a client (agencies & vibe-coding freelancers)

Before sending the final invoice

• No secret key (sk_live_, service_role, AWS key) appears in the JavaScript served to the browser — check by searching the files loaded in the DevTools Network tab.
• /.env and /.git/config return a 404, not the file's content.
• If the project uses Supabase (or equivalent), RLS is enabled on every table and at least one SELECT/INSERT/UPDATE policy has been read line by line — not just tested "it works while logged in".
• Basic security headers are present: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options. Most modern frameworks don't add these automatically.
• The site is served over HTTPS with a forced redirect from HTTP — not just "HTTPS available if you type the URL with it".
• If the client accepts payments, the Stripe secret key is only used server-side (API route / webhook), never in a client component.

Why check it yourself, not just trust the scaffold

The client usually won't notice a security vulnerability until it's been exploited — but if there's a data leak or a bypassed payment after your delivery, it's your credibility that takes the hit, not the AI tool's that you used to generate the code. A 10-minute checklist costs far less than an incident after delivery.

Automate the check and prove it to your client

Running through this list by hand on every project gets repetitive fast. A Vetora scan automates these checks (and a few more) in one pass, and generates a dated, numbered certificate, publicly verifiable by your client — concrete proof to attach to your delivery or final invoice, rather than just a verbal promise that "it's secure".

Scan your next client project before sending it off.