The catalogue is a fixed, published list of 77 application-level security controls. Each one is a testable statement about the application: a thing that is either true or not, checked in a stated way, satisfying named requirements, with a rule for when it applies.
The requirements come from four published sources: OWASP ASVS 5.0, the application-level articles of the GDPR, the application-level articles of the EU AI Act, and the OWASP Top 10 for LLM Applications 2025. A control that satisfied no published requirement was removed from the catalogue; that discipline is what replaces judgement.
The thirteen categories
- Authentication and sessions
- 16 controls, ASVS V6, V7 and V9. Who is this, and is the login itself defensible?
- Access control
- 5 controls, ASVS V8. Can a user reach only their own data? The single most common catastrophic failure in vibe-coded apps.
- Input and injection
- 6 controls, ASVS V1 and V2. Is untrusted input ever treated as code, a query, or HTML?
- Secrets and cryptography
- 6 controls, ASVS V11 and V13. Are keys protected and kept out of the code and the browser?
- Data and privacy
- 6 controls, ASVS V14 and V15 and the GDPR. Is personal data collected, exposed, logged and retained responsibly?
- Encryption in transit
- 4 controls, ASVS V12 and V3. Is every byte between the user and the app encrypted, always?
- Errors and logging
- 4 controls, ASVS V16 and V13. Does the app fail safe and keep a trail without leaking secrets?
- Business logic and abuse
- 3 controls, ASVS V2 and V13. Can the app be abused by automation, or tricked into trusting the client about money?
- Files and uploads
- 4 controls, ASVS V5 and V13. Can an uploaded file become an attack?
- API and web services
- 5 controls, ASVS V3, V8 and V14. Is every API route guarded, and is cross-origin access deliberate?
- Configuration and dependencies
- 7 controls, ASVS V3, V13 and V15. Is production hardened, and are known-vulnerable packages being watched?
- AI security and transparency
- 7 controls, the OWASP LLM Top 10 and the EU AI Act. Can the model be hijacked, and are users told they are talking to one?
- Governance
- 4 controls, the GDPR and ASVS V13 and V14. Do the documents you publish match what the app verifiably does?
Tiers, not severities
Forty-one controls are Level 1: they satisfy at least one requirement OWASP places in the minimum set. Twenty-five are Level 2, six are Legal and five are Advisory. Nobody at VibeLock chose those numbers; they follow from what each control satisfies.
Provider-owned controls
When a managed authentication provider runs your login, eight authentication controls are the provider’s responsibility: password storage and rules, password change, reset and activation secrets, session token generation, session lifetime, and MFA availability. They are marked provider-owned and count as verified once the probe has corroborated the provider in your served app. Provider ownership is derived from the profile; it is not a status you can set.
The free checklist carries the same 77 controls with the same identifiers, the same requirement references and the same lanes. Anything you verify by hand from the checklist maps one to one onto what the platform verifies.