← all checklists

Vibe-Coding Release Gate

43 items · source

Copy as markdown

Filter items

Release Gate

Do not consider AI-generated functionality production-ready until:

• Human reviewed the security architecture.
• Human reviewed authentication.
• Human reviewed authorization.
• Human reviewed tenant isolation.
• Human reviewed database/RLS changes.
• Human reviewed Storage changes.
• Human reviewed secrets.
• Human reviewed dependencies.
• Human reviewed CI/CD changes.
• Human reviewed infrastructure changes.
• Human reviewed mobile security changes where applicable.
• Automated security scanning passes.
• Authorization regression tests pass.
• Negative security tests pass.
• No production secret was introduced.
• No permission was unintentionally widened.
• No security control was silently removed.
• No new public endpoint was unintentionally exposed.
• AI-generated tool/agent permissions remain least privilege.
• Security-sensitive generated code has a human owner.

Red Flags

Any of these should trigger manual security review:

• AI added an authentication library.
• AI changed authentication/session code.
• AI changed authorization/roles.
• AI introduced a new admin endpoint.
• AI introduced a "temporary" bypass.
• AI disabled a failing security test.
• AI changed CORS.
• AI changed CSP.
• AI changed cookies.
• AI changed TLS.
• AI added external dependencies.
• AI added shell execution.
• AI added file processing.
• AI added URL fetching.
• AI added SQL.
• AI added a WebView.
• AI added native entitlements.
• AI changed IAM.
• AI changed DNS.
• AI changed production deployment.
• AI added an AI agent/tool.
• AI added RAG/memory.
• AI gave another AI agent additional privileges.