Free checklist
Built it with AI? 10 checks before real users arrive.
Apps made with Lovable, Bolt, Cursor, Replit or Claude Code can work perfectly and still leak keys, data or money. Each check takes a few minutes. Tick it, or fix it before launch.
- 1
No secret keys in the browser
Check. Open your app, press F12, go to Sources and search for sk and secret.
Fix. Call OpenAI, Stripe and similar APIs from a server function, keep the key as a secret, and rotate any key that was ever exposed.
Source: OpenAI: API key safety · Stripe: API keys
- 2
Database access rules are on
Check. In Supabase (or your database), every table has row level security on, with policies. Try to read a table while logged out.
Fix. Turn on row level security and write a policy per table. A public "anon" key is meant to be visible only because these rules protect the data.
- 3
Every page and API checks who is asking
Check. In a private window, open an inside page or call an API without logging in. Change an id in the URL to someone else's.
Fix. Check the login and the ownership on the server for every route, not only in the screen.
- 4
Inputs are checked on the server
Check. Submit your forms empty, with very long text, and with code in them.
Fix. Validate types and lengths on the server too; the form's own checks are easy to skip.
Source: OWASP: input validation
- 5
Payments go through a hosted checkout
Check. Does card data ever touch your own server or code?
Fix. Use the provider's hosted checkout (for example Stripe Checkout) and confirm payments from its webhook, not from the browser.
Source: Stripe Checkout
- 6
Backups exist, and you have restored one
Check. When did the last backup run? Have you ever restored it into a test copy?
Fix. Turn on daily backups (or point-in-time recovery) and do one test restore before launch.
Source: Supabase: backups
- 7
Errors reach a person
Check. Break something on purpose. Does anyone get told?
Fix. Add error tracking with an email or chat alert, so you hear about a problem before your users tell you.
Source: Sentry docs
- 8
Privacy basics for the data you keep
Check. Is there a privacy policy that says what you collect, why, where it is stored and how someone asks for deletion?
Fix. Write it for the data you really keep, and follow the law where your users are: GDPR in the UK and EU, POPIA in South Africa.
Source: ICO: UK GDPR guidance · Information Regulator (POPIA)
- 9
Logins and forms have rate limits
Check. Can you try 50 wrong passwords in a row, or submit a form 100 times a minute?
Fix. Limit attempts per account and per address, and slow down repeats.
Source: OWASP: authentication
- 10
Secrets live in environment variables, not the code
Check. Search your repository and its history for keys. Is .env in .gitignore?
Fix. Keep secrets in your host's environment settings and rotate anything that was ever committed.
Source: Vercel: environment variables
General guidance, not legal advice.
Get the printable PDF
The same ten checks on two pages, to tick off with your team before launch day.
Want a second pair of eyes?
Send us what you built. We look at it before your users do, tell you what we would fix first, and quote a fixed price if you want us to fix it.