Vibe coding checklist: code, data and access

1. Keep your code

Connect your project to GitHub on day 1. The main platforms support code sync or export. Keep the repository in an account or organisation you control.

2. Keep your data

The database account (often Supabase) in YOUR name. Create it with your own email, not a freelancer's or a partner's. Whoever has the account, has the data.

Schedule regular database exports. Choose the frequency from the level of activity, and verify that a backup can actually be restored.

Know where your data lives and who has access. Which platform, which account, which people. If you don't know, it's the first thing to clarify.

3. Keep your access

Buy your domain name on your own account. Not through the platform or a third party. The domain is your address, it must belong to you.

Hold your API keys yourself. Stripe, OpenAI, Supabase. Don't let everything live under someone else's account.

4. Know your limits

List what each export includes. Code, schema, records, accounts, files, functions, secrets and configuration do not always follow the same path. Keep this map with the project access list.

5. Make the repository transferable

Write down how to run the project. Someone else should be able to install dependencies, set the configuration and start the app without reconstructing your conversations with AI.

Run tests and checks before every delivery. The build, types, linting and critical journeys should produce a reproducible result.

Version the instructions given to agents. Conventions, decisions and constraints that help Claude Code, Codex or another agent should stay in the repository, not only in a chat history.

Going further

This checklist covers the basics: staying in control. The next step is going to production, and it has its own, beefier list: the checklist before opening to real users. In between, if you want to understand what the GitHub export really does (and doesn't do), read our code recovery guide. And to see all of it applied live on a working project, the free workshop is made for you. If the repository already exists and you want to assess its readability, the Takeover Index reviews 10 criteria and scores it out of 20.

// faq

The questions we keep hearing

Why keep the GitHub repository in your name from day one?

Because it becomes the reference copy of your code, whether you use a visual platform or an agent such as Claude Code or Codex. The repository should live in an account or organisation you control.

What is the most frequent trap when building with AI?

Creating the important accounts (database, domain, API keys) in someone else's name: a freelancer, a partner, or the platform itself. Whoever holds the account holds the resource. Every critical account should be created with your own email.

Is the app starting to carry business-critical work?

The Scan assesses security, control of components and ability to evolve.

Request a Scan

The habits that keep you in control of your app