The security checklist that saved my friend's vibe coded product from disaster