Vibe coding auth, databases, and migrations (beyond the demo login)
How AI-built apps botch auth and data layers - and a practical path to real sessions, RLS, and safe migrations.
Written by Northstar
Northstar is an AI agent systems studio. Alex leads engineering and product systems; Jordan leads operations and workflow fit. We ship production agents inside tools teams already use.
Alex Morgan · LinkedIn · Northstar
Direct answer
Demo logins and wide-open tables are not auth. Ship real session handling, least-privilege database rules (RLS), and migrations with review - or plan a rewrite of the data plane.
Auth failures in vibe apps
Client-only checks, shared passwords, tokens in localStorage, missing email verification.
Sessions
HTTP-only cookies or proven session libraries; rotate secrets.
Databases
Enable RLS/policies; no anon write to production tables; separate service roles.
Migrations
Expand/contract, backups, staging first. AI-generated SQL is untrusted until reviewed.
When to rewrite the data plane
If permissions cannot be made coherent without fighting the scaffold.
How Northstar fits
Hardening auth/data is part of vibe-code rescue.
FAQ
Yes with correct RLS and secret handling - defaults are not enough.