Platform checklists
A security checklist for the tool you build with
Each AI coding tool leaves different things to you. Find yours, see what to verify in the generated project, and how to test it.
Platform checklist
Securing an app built with Lovable: a review checklist
A review checklist for a Lovable project: database rules, keys in the bundle, edge functions, sensitive data and the built-in security checks.
Platform checklist
Securing an app built with Bolt: a pre-deploy review checklist
A review checklist for a Bolt project: the built-in security audit, secrets, database rules, authentication and what to test on the published site.
Platform checklist
Securing an app built with v0 and Next.js: a review checklist
A review checklist for a v0 project: server versus client code, NEXT_PUBLIC variables, route handlers, authorization, deployment settings and dependencies.
Platform checklist
Securing code written with Cursor: a review checklist
A review checklist for a project built with Cursor: agent permissions, terminal commands, MCP servers, rules files, secrets and reviewing AI diffs.
Platform checklist
Securing an app built and hosted on Replit: a checklist
A review checklist for a Replit project: Secrets, published app settings, database access, authentication, input handling and what a public link exposes.
Platform checklist
Securing code written with Windsurf: a review checklist
A review checklist for a project built with Windsurf: Cascade command auto-execution, allow and deny lists, MCP servers, secrets and reviewing AI edits.
Platform checklist
Supabase security checklist for AI-built apps
Review a Supabase project in an hour: RLS, API keys, storage policies, auth settings, edge functions and views, with queries you can run yourself.
Platform checklist
Firebase security checklist for AI-built apps
Review Firestore, Realtime Database and Storage rules, App Check, Auth and API key restrictions on your own Firebase project, with commands to test them.
Platform checklist
Vercel security checklist for AI-built apps
Check environment variable scopes, preview protection, headers, server actions, route handlers and logs on a Vercel project, with commands you can run yourself.
Platform checklist
Netlify security checklist for AI-built apps
Check Netlify environment variable scopes, deploy previews, the _headers file, functions and forms on your own site, with commands and pass conditions.
Platform checklist
Securing an app built with Base44: a review checklist
A review checklist for a Base44 app: visibility, data permissions, backend functions, service role use, secrets and the built-in security scan.
Platform checklist
Securing code written with Claude Code: a review checklist
A review checklist for projects built with Claude Code: permission settings, sensitive files, MCP servers, secrets and the code it writes.
Platform checklist
Securing code written with GitHub Copilot: a review checklist
A review checklist for code written with GitHub Copilot: suggestions, the cloud agent's pull requests, content exclusion, push protection and tests.
Platform checklist
Securing a Firebase Studio app: a review checklist
A review checklist for an app prototyped in Firebase Studio: Firestore rules, keys in env files, App Hosting secrets, server code and the sunset.
Platform checklist
Next.js security checklist for AI-built apps
Review a Next.js app: server actions, route handlers, proxy or middleware checks, NEXT_PUBLIC_ variables and data passed to client components.
Platform checklist
Clerk security checklist for AI-built apps
Review a Clerk integration: server-side auth checks, keys, user metadata and roles, webhook verification, sign-up restrictions and production settings.
Platform checklist
Securing a Stripe integration in an AI-built app: a checklist
Review a Stripe integration: key placement, restricted keys, webhook signature checks, server-side prices, fulfilment and the move from sandbox to live.
Platform checklist
Cloudflare Workers security checklist for AI-built apps
Review a Cloudflare Worker: secrets and vars, workers.dev and preview URLs, auth in the fetch handler, D1 queries, rate limits and shared global state.
Ready to check your own app?
Sign in with Google or email, add your site and run your first scan free.