The 10-point launch checklist for AI-built apps
Ten checks to run before you share your Lovable, Bolt, Replit or Cursor app with real users. Each takes 2–10 minutes and needs no coding. If a check fails, ask your AI builder to fix it, then run the self-test again.
Want a copy in your inbox? We'll email it to you, plus one follow-up a day later.
Security: protect your users' data
Why: Without row-level security (RLS) on Supabase, or rules on Firebase, anyone with your public key can read or change every row. A 2025 flaw in Lovable-built apps worked exactly this way and was rated 9.3 Critical (CVE-2025-48757).
Self-test: Open your Supabase dashboard → Table Editor. Any table marked "RLS disabled", or with a policy that allows all users, fails.
Why: Anyone can read your front-end code. A Stripe secret key, OpenAI key or Supabase service_role key there lets strangers spend your money or bypass every rule.
Self-test: Open your live site, press F12 → Sources (or View Source), and search for sk_, service_role and api_key.
Why: A paywall that only hides a button can be skipped with browser developer tools (Indie Hackers).
Self-test: Log in as a free user and try to open a paid page's URL directly.
Why: If a page URL has an ID in it (/invoice/123), changing it to 124 shouldn't show someone else's invoice.
Self-test: Make two test accounts. Copy a private page URL from account A and open it while logged in as account B.
Why: Broken auth is the most common way first users get stuck or locked out.
Self-test: With a fresh email, sign up, confirm the email, log out, reset the password, and log back in. Then try a wrong password 10 times.
Reliability: make sure it works for real people
Self-test: In Stripe test mode, pay with test card 4242 4242 4242 4242, then with a declining test card. Check the user gets access only after a successful payment, and that a refund removes it.
Self-test: Submit each form empty, with a very long value, with emoji, and twice quickly. You should see clear errors and no duplicate records.
Self-test: Open the app on an iPhone (Safari) and an Android phone. On desktop, press F12 → Console and click through each page: red errors mean something is broken. Click every link and button once.
Self-test: Make sure the address bar shows a padlock on every page, and that http:// redirects to https://. Paste your URL into a free header checker such as securityheaders.com.
Why: One bot hitting your AI feature can run up a large bill overnight, and one bad AI edit can break the live app.
Self-test: Confirm you have a monthly spending cap set with your AI and email providers, a per-user rate limit on AI features, and that you know how to restore the last working version and a database backup.
Want a second pair of eyes?
This checklist catches common problems, but not everything. In a Quick Audit ($199), a QA lead with over 10 years of experience runs these checks and more on your live app, and sends a plain-English report within 48 hours, with a paste-ready fix prompt for every issue found.
Sources: CVE-2025-48757 record · Indie Hackers: Vibe coding has a security problem. This checklist is a self-check, not a security guarantee.