Vibe-Coded Legal Audit
Oct 6, 2026
Why this exists
AI coding tools optimize for "it works". They do not optimize for "it won't get you sued". So the app runs, the demo looks great, and ten legal problems ship with it.
None of the fines below are a percent of revenue. They are per visitor, per email, per text, per image. That is how an app with zero sales turns into a six-figure problem.
One prompt fixes all of it. Copy it, run it from the root of your project, and read the table it gives you back.
The prompt
Copy this as it is. Run it from the root of your project so the AI can see every file.
I don't want to get sued on my vibe-coded app. Audit the whole codebase for legal exposure and fix every issue you find. Work through this list in order, make the changes directly, and at the end give me a table with each item, what you changed, and the file you touched. 1. COPPA - Add an age check to the signup form. Block anyone under 13 from creating an account and do not store their data. If we already collect birthdates, make sure they are not stored in plain text. 2. Google Fonts - Find every font loaded from fonts.googleapis.com or fonts.gstatic.com. Download the font files, self-host them in the project, and update the CSS so no request ever goes to Google. 3. Session replay and tracking - Find every analytics or session replay tool (PostHog, Hotjar, FullStory, Microsoft Clarity, LogRocket, Mixpanel, Meta Pixel, etc.). Turn session replay off by default, mask all text inputs, and load every tracker only after the user gives consent in a cookie banner. Add that banner if it does not exist. 4. Email compliance - Find every marketing or launch email template. Add a working unsubscribe link and a physical postal address to the footer of each one. Make sure unsubscribe requests are honored within 10 days and the sender name and subject line are not misleading. 5. SMS - If the app sends any text messages, add a prior express written consent checkbox (unchecked by default) before collecting phone numbers, store the consent timestamp, and add STOP handling. 6. Supabase or database security - Enable row-level security on every table. Write policies so users can only read and write their own rows. Confirm the service role key is never shipped to the client. List every table and its policy. 7. Accessibility - Make every interactive element reachable and usable with the keyboard, add visible focus states, add alt text to every image, add labels to every icon button and form field, check color contrast meets 4.5:1, and add captions support to any video player. 8. Copyright agent - If users can upload images or any content, draft the text I need to register a DMCA designated agent at dmca.copyright.gov (it costs 6 dollars), add a copyright policy page with the takedown process, and add a report button on user content. 9. Legal pages - Check for a privacy policy, terms of service, cookie policy, and refund policy. Draft any that are missing based on what the app actually does and the data it actually collects, and link them in the footer and at signup. 10. Subscriptions - If we use Stripe or any recurring billing, show the price, renewal frequency, and how to cancel right next to the subscribe button, and make sure cancellation is possible online in the same number of clicks as signing up. Do not skip anything. If an item does not apply to this project, say why. Finish with the table of changes.
The last line matters. "If an item does not apply, say why" stops the model from silently skipping things, and the table at the end is your proof of what changed.
The 10 risks explained
No age check on signup - COPPA
If a child under 13 can create an account, US law treats you as collecting children's data without parental consent. The penalty is up to $53,088 per violation, and each child counts.
The fix is a birthdate or age confirmation step at signup that blocks under-13s and does not store their data.
Fonts loaded from Google - GDPR
When your CSS pulls a font from fonts.googleapis.com, the visitor's IP address is sent to Google in the US before they agree to anything. A Munich court ruled in January 2022 that this violates GDPR and awarded a visitor 100 euros in damages, with a 250,000 euro penalty threatened for repeat offences.
The fix is to download the font files and serve them from your own project. Same fonts, zero requests to Google.
Session replay on by default - California CIPA
Tools like Hotjar, Microsoft Clarity, FullStory and PostHog can record every keystroke and mouse movement. In California, plaintiffs argue this is wiretapping under the Invasion of Privacy Act, with statutory damages of $5,000 per violation. Hundreds of these suits were filed in 2024 and 2025.
The fix is to turn replay off by default, mask all inputs, and only load trackers after consent.
Launch email with no unsubscribe or address - CAN-SPAM
Every marketing email needs a working unsubscribe link and a physical postal address. Without them, the FTC can fine up to $53,088 per email sent. Not per campaign. Per email.
The fix is a compliant footer on every template and an unsubscribe that works within 10 days.
Texting your waitlist without written consent - TCPA
Marketing texts need prior express written consent. Without it, each text is $500 in statutory damages, $1,500 if the court finds it willful, and it is strict liability. 10,000 texts is a $5 million exposure.
The fix is an unchecked consent box before you collect a phone number, a stored timestamp, and STOP handling.
Supabase tables with no row-level security
Supabase exposes a REST API on every table by default. Without row-level security policies, anyone holding your public key, which is already in your JavaScript, can read the whole users table. A scan of 1,645 live Lovable projects found about 1 in 10 had exactly this.
The fix is RLS on every table with policies scoped to the signed-in user, and the service role key kept server-side only.
No keyboard navigation, no alt text - accessibility lawsuits
Around 5,000 web accessibility lawsuits were filed in the US in 2025, most of them against small e-commerce businesses. In the EU, the European Accessibility Act has applied to websites and apps since June 2025.
The fix is keyboard access on every control, visible focus states, alt text on every image, labels on every icon button, and 4.5:1 contrast.
No DMCA agent - $6 you forgot to spend
If users can upload images, one of them will upload something they do not own. Registering a DMCA designated agent with the US Copyright Office costs $6 and gives you safe harbor. Without it, willful infringement damages run up to $150,000 per work, and the claim lands on you.
The fix is the registration at dmca.copyright.gov, a copyright policy page, and a report button on user content.
No privacy policy, terms or refund policy - GDPR
If your app collects an email address, GDPR requires you to tell users what you collect, why, and how long you keep it. Serious breaches can be fined up to 4% of global annual revenue or 20 million euros, whichever is higher. Payment providers like Stripe and the app stores also expect clear terms and a refund policy before they let you sell.
The fix is a privacy policy, terms of service and refund policy written from what your app actually does, linked in the footer and at signup.
Hidden renewal terms - California Automatic Renewal Law
If a subscription renews without clear terms next to the subscribe button, California treats whatever you shipped as an unconditional gift. That means a customer can ask for every renewal back. The law also requires online cancellation that is as easy as signing up.
The fix is the price, the renewal frequency and how to cancel shown right next to the button, plus a cancel flow that takes the same number of clicks as subscribing.
Before you ship
Run these three checks after the prompt finishes. Two minutes.
- Open your site in a private window and press Tab ten times. You should see a visible focus ring move through the page. If nothing moves, the accessibility fix did not land.
- Open dev tools, go to Network, reload, and filter by "google". No font requests should appear.
- In Supabase, open any table and check the RLS badge. Every table should say enabled, and every table should have at least one policy.
If any check fails, paste the failing item back into the same chat and say "this did not work, fix it and show me the diff".
The one thing to remember
Nothing on this list is a percent of revenue. It's per. Run the prompt before you ship, not after the first email from a lawyer.
This guide is general information, not legal advice. Figures verified September 2026 against FTC, court, and industry sources. Check the rules for your own country and product.