Free tool, saved in your browser

Pre-launch security checklist for AI-built apps

Built something with Lovable, Bolt, Cursor, v0 or Replit and about to share it? Pick your stack, work through the items that apply, and export your progress as Markdown. Each item says why it matters and how to check it.

What is your app built with?

General items are always shown. Turn off anything you do not use to hide items that do not apply.

0 of 52 done (0%)

Secrets & keys

0/6

No secret keys in frontend code or public env varsAnything prefixed NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_ is copied into the JavaScript every visitor downloads.How to check: Paste your variable names into the env checker, then search your built JavaScript for strings like sk_live, service_role and secret.
Env variable checker Fix: secret in a public env var
AI provider keys are only used on a serverAn OpenAI or Anthropic key in the browser lets anyone run requests on your bill.How to check: Open your app with the browser's network tab open. Requests going straight from the page to an AI provider's API mean the key is exposed.
Guide: exposed API keys
The Supabase service_role key is server-onlySupabaseIt bypasses Row Level Security, so whoever has it can read and change every table.How to check: Search your repository and your deployed JavaScript for the service key. It should only exist in server-side environment variables.
Fix: service_role key exposed
.env files are not in git, now or in historyA key committed once stays readable in the repository history even after you delete the file.How to check: Confirm .env is listed in .gitignore and run git log --all -- .env to see whether it was ever committed.
Guide: secret scanning
Any key that was ever exposed has been rotatedDeleting a leaked key from your code does not stop the copy someone already has from working.How to check: Regenerate the key in the provider's dashboard, update your environment variables, redeploy, then revoke the old key.
Your site does not serve .env or .git filesSome hosting setups serve these files to anyone who asks for them by name.How to check: Open /.env and /.git/config on your live domain in a private window. Both should return a 404.
Fix: .env publicly accessible Fix: .git exposed

Database access

0/6

One user cannot see another user's dataThis is the most common serious bug in AI-built apps, and only a real test catches it.How to check: Create two accounts. Signed in as the first, try to open the second account's records by changing ids in URLs and requests.
Guide: two-account test
Row Level Security is enabled on every public tableSupabaseThe anon key is public, so a table without RLS can be read and changed by anyone through the API.How to check: Run select tablename from pg_tables where schemaname = 'public' and not rowsecurity; in the SQL editor. It should return nothing.
Fix: RLS disabled RLS policy generator
Policies on private data are not using (true)SupabaseA policy with using (true) for the authenticated role lets any signed-up stranger read every row.How to check: Review each table's policies in the dashboard and confirm private tables compare a column to auth.uid().
Guide: RLS policy patterns RLS policy generator
Views over private tables use security_invokerSupabaseViews run with their creator's permissions by default, which skips the RLS on the tables underneath.How to check: List the views in your public schema and recreate any that read private tables with security_invoker = true (Postgres 15 and later).
Firestore and Realtime Database rules are not openFirebaseRules like allow read, write: if true, or test-mode rules with a future date, let anyone read and overwrite your data.How to check: Open the Rules tab for each database in the Firebase console and look for if true or a request.time condition.
Fix: rules allow if true Guide: Firebase rules check
Rules compare request.auth.uid to the document ownerFirebaseChecking only that request.auth is not null lets every signed-in user read everyone's documents.How to check: Test your rules in the Rules Playground as one user reading another user's document. It should be denied.

Authentication

0/5

Admin features are checked on the server, not just hiddenHiding a button does nothing: anyone can call the underlying API or database directly.How to check: Signed in as a normal user, call an admin action directly (for example by replaying the request). It should be refused.
Roles come from app_metadata, never user_metadataSupabaseUsers can edit their own user_metadata, so a role stored there can be granted by anyone to themselves.How to check: Search your policies and code for user_metadata and make sure none of it decides what a user may do.
RLS policy generator
Login redirect URLs are limited to your own domainsLoose redirect settings can send users, and their login links, to a domain you do not control.How to check: Review the redirect URL allow list in Supabase Auth settings or the authorized domains in Firebase Authentication, and remove anything you do not own.
Unused sign-in methods are turned offEvery enabled provider is another way in that you have to keep configured correctly.How to check: Open your auth provider settings and disable any sign-in method your app does not offer.
Tokens expire and logout actually ends the sessionLong-lived tokens that keep working after logout extend the damage of any stolen session.How to check: Decode a session token and check its exp claim, then confirm a logged-out session can no longer load private data.
JWT decoder

API & server

0/7

Every endpoint checks who is asking and what they ownNext.js / Vercel / Custom APIAn endpoint that trusts an id sent by the browser will hand any record to anyone who guesses the id.How to check: For each route that reads or changes data, confirm it loads the user from the session and filters by that user.
Server Actions and Route Handlers verify the user themselvesNext.js / VercelServer Actions can be called with a direct POST request, so a check in the page or in middleware alone is not enough.How to check: Open each Server Action and Route Handler and confirm it checks the session before touching data.
Input is validated on the serverNext.js / Vercel / Custom APIBrowser-side validation is skipped by anyone who sends requests directly.How to check: Check that each endpoint validates types, lengths and allowed values with a schema before using them.
Login, signup and expensive endpoints are rate limitedNext.js / Vercel / Custom APIWithout limits, attackers can guess passwords, spam signups or run up your AI and email bills.How to check: Send the same request quickly in a loop against staging and confirm you start getting 429 responses.
Guide: rate limiting
Errors do not leak stack traces or queriesNext.js / Vercel / Custom APIDetailed errors show attackers your file paths, libraries and database structure.How to check: Trigger an error in production (a bad id works) and check the response shows a generic message.
CORS does not allow every origin with credentialsCustom APIReflecting any Origin while allowing credentials lets other websites make logged-in requests as your users.How to check: Send a request with Origin: https://example.com and check the response does not echo it back with Access-Control-Allow-Credentials: true.
Preview deployments do not expose production dataNext.js / VercelPreview URLs are easy to share and find, and often run with production keys.How to check: Check which environment variables your previews use and turn on deployment protection if they reach real data.

Payments

0/5

Prices and amounts are set on the serverStripe / RazorpayAn amount sent from the browser can be edited to 1 before it reaches your payment provider.How to check: Confirm your checkout endpoint looks up the price from its own data instead of reading it from the request.
Webhooks verify the provider's signatureStripe / RazorpayAnyone can POST a fake 'payment succeeded' event to an unverified webhook URL.How to check: Check your handler verifies the Stripe-Signature or X-Razorpay-Signature header with your webhook secret before acting.
Access is granted from a verified payment, not the success pageStripe / RazorpayAnyone can open your success URL directly without paying.How to check: Visit the success page without paying and confirm nothing is unlocked.
Webhook handling is safe to receive twiceStripe / RazorpayProviders retry deliveries, so the same event can arrive more than once.How to check: Record processed event ids and skip ones you have already handled.
Live secret keys are server-only and separate from test keysStripe / RazorpayA live secret key can issue refunds, read customer data and create charges.How to check: Confirm only publishable keys reach the browser and that production uses live keys while staging uses test keys.
Env variable checker

Headers & HTTPS

0/5

HTTPS everywhere, with HSTSHSTS tells browsers to always use HTTPS, so nobody on the network can downgrade the connection.How to check: Run curl -sI https://your-domain and look for Strict-Transport-Security.
Security headers generator Fix: missing HSTS
A Content-Security-Policy, rolled out report-only firstA CSP limits where scripts can load from, which reduces the damage of injected code.How to check: Check the response headers for Content-Security-Policy or its Report-Only version.
CSP builder
Other sites cannot frame your pagesFraming lets another site overlay your pages and trick users into clicking buttons.How to check: Look for frame-ancestors in your CSP or an X-Frame-Options header.
Security headers generator
Session cookies are Secure, HttpOnly and SameSiteThese flags stop cookies leaking over HTTP, being read by scripts, or being sent by other sites.How to check: Open the browser's storage panel and check the flags on each session cookie.
Fix: cookie flags
No mixed contentHTTP resources on an HTTPS page can be blocked by browsers or tampered with in transit.How to check: Load your main pages with the browser console open and look for mixed content warnings.
Fix: mixed content

Files & storage

0/4

Uploads have type and size limits enforced server-sideWithout limits, users can upload huge files or HTML that runs when someone opens it.How to check: Try uploading an oversized file and an .html file. Both should be rejected by the server or storage rules.
Private files are not in public bucketsFiles in a public bucket can be downloaded by anyone who has or guesses the URL.How to check: Open a private file's URL in a signed-out private window. It should fail, or work only through a short-lived signed URL.
Supabase Storage buckets have their own policiesSupabaseTable policies do not cover files. Storage access is controlled by policies on storage.objects.How to check: Review the policies for each bucket in the Storage section of the dashboard.
Guide: private file uploads
Cloud Storage for Firebase has its own rulesFirebaseStorage rules are separate from database rules and can be left in test mode by accident.How to check: Open the Storage Rules tab in the Firebase console and check who can read and write each path.

Monitoring & recovery

0/6

Errors in production reach youYou cannot fix what you never hear about, and users rarely report broken pages.How to check: Throw a test error in production and confirm it shows up in your error tracker or logs.
Backups exist and you have tried a restoreA backup you have never restored may not work when you need it.How to check: Check which backups your database plan actually includes, then restore one into a separate project.
Spending limits or billing alerts are setLeaked keys and traffic spikes show up first as a surprise bill.How to check: Set budget alerts with your cloud, database, email and AI providers.
Logs do not contain passwords, tokens or card detailsLogs are copied to more places and people than your database.How to check: Search recent logs for authorization headers, tokens and request bodies from login and payment routes.
Dependencies have no known critical vulnerabilitiesAI tools often add packages you did not choose, some of them outdated.How to check: Run npm audit (or your package manager's equivalent) and update anything flagged critical.
You know how to rotate keys and sign everyone outIn an incident, minutes matter and a plan beats searching docs.How to check: Write down where each key lives and how to revoke sessions, and try it once on staging.

Privacy & legal basics

0/4

A privacy policy that matches what you actually collectUsers and app stores expect to know what you collect and which services receive it.How to check: List every form field, analytics tool and third-party service, and check each appears in your policy.
You collect only what the app needsData you never collect cannot leak.How to check: Review signup and profile fields and remove any you do not use.
Users can delete their account and dataMany privacy laws give people a right to deletion, and app stores may require it.How to check: Delete a test account and confirm its rows and files are gone, not just hidden.
Cookie and tracking consent where the law requires itIn places like the EU and UK, non-essential cookies and trackers generally need consent first.How to check: Load your site in a fresh browser and check whether analytics or ad cookies are set before any choice is made.

Search & sharing

0/4

Staging and preview sites are marked noindexIndexed staging copies compete with your real site and can expose unfinished features.How to check: Check the staging response for an X-Robots-Tag: noindex header or a robots noindex meta tag.
Can Google see my site?
Production is not accidentally blocked from searchA leftover noindex or Disallow: / from development keeps your launch invisible.How to check: Check your production robots.txt and page headers, and test the home page.
Can Google see my site?robots.txt generator
robots.txt does not list secret pathsrobots.txt is public and does not block access, so listing admin paths there advertises them.How to check: Read your robots.txt as a stranger would. Protect private paths with authentication instead.
robots.txt generator
Open Graph tags and a share image are setWithout them, links to your app look broken or empty when shared on social apps and chat.How to check: Check og:title, og:description and og:image on your main pages.
OG preview checker

Your progress is saved only in this browser. Nothing is sent anywhere. A checklist reduces common mistakes; it is not a security audit or a guarantee that your app is safe.

Where to start if you only have an hour

Some items matter far more than others. If time is short, do these first, because they are the ones that expose other people's data or cost you money.

1Search your frontend code and public environment variables for secret keys, and rotate anything you find.
2Confirm database access is locked down: RLS on every Supabase table, or Firebase rules that are not open.
3Run the two-account test: sign in as one user and try to read another user's data.
4If you take payments, make sure prices are set on the server and webhooks check signatures.

Why AI-built apps need a checklist

AI coding tools are good at making features work. They are less reliable at the parts nobody sees in a demo: who is allowed to read which rows, where keys live, and what happens when someone sends a request your interface never would.

Most launch problems are not clever attacks. They are defaults left on: a table without Row Level Security, a secret key in a public environment variable, test-mode database rules, or a success page that unlocks access without checking the payment.

How to use this checklist

Choose the services your app uses. Items for services you turn off are hidden; general items always stay.
Check an item only after you have actually done the how-to-check step, not because you believe it is fine.
Your ticks are saved in this browser only. Use Copy as Markdown to paste progress into an issue, a README or a message to your team.
Run through it again before each major release, especially after an AI tool has made large changes.

Frequently asked questions

Is my progress sent anywhere?

No. Your ticks and stack choices are stored in your browser's local storage on this device only. Nothing is sent to our servers. If your browser blocks storage, the checklist still works but will not remember progress.

Is this checklist enough to launch safely?

It covers common, high-impact mistakes, but it is not a security audit or a guarantee. Apps that handle health, financial or children's data deserve a professional review as well.

Why is the Supabase anon key not on the list of secrets?

The anon key is designed to be public and ships in your frontend. What protects your data is Row Level Security on each table. The service_role key is the one that must never reach the browser.

Is a Firebase API key a secret?

Firebase web API keys identify your project and are expected to appear in client code. Your data is protected by Firebase Security Rules, which is why the checklist focuses on those.

What is the two-account test?

Create two accounts, sign in as the first, and try to view or change the second account's data by editing ids in URLs or requests. If it works, your access rules are broken.