AI builders like Lovable, Bolt, Replit, and Cursor can take you from idea to working app in a weekend. What they don't do is tell you when that app is ready for strangers, real money, and real data.
This checklist is for that moment. You don't need to be an engineer to run most of it. Each check comes with a quick way to test it yourself.
1. No secret keys in the browser
Anything your app sends to the browser can be read by anyone. Open your live site, open the browser's developer tools, and search the loaded JavaScript for words like secret, service_role, sk_live, or sk-.
If you find a secret key, treat it as already stolen: rotate it first, then move the code that uses it to the server. Our guide on keeping API keys out of your frontend walks through it.
2. Users can only see their own data
This is the most common serious issue in AI-built apps. Sign up as two different test users. As user A, create something private. As user B, try to see it, by browsing, by changing IDs in the URL, or by calling the API directly.
If you use Supabase, check that row-level security is enabled on every table. Here's our Supabase RLS checklist.
3. Sign-up, login, and password reset are solid
Test the boring flows: wrong passwords, expired reset links, signing in with Google and then with email using the same address, and logging out on one device. Account takeovers usually come through the flows nobody tested.
4. The server checks everything
Form checks in the browser are for convenience. Anyone can skip the browser and send whatever they like straight to your API. Every limit that matters, such as prices, quantities, roles, and who owns what, must be checked on the server.
5. Expensive routes are rate-limited
Login, sign-up, password reset, and anything that calls a paid API (AI models, SMS, email) need rate limits. Without them, a single bot can lock out your users or spend your monthly AI budget overnight.
6. Payments match reality
If you use Stripe or a similar provider, your app should learn about payments from verified webhooks, not from the browser saying "payment succeeded". Test what happens when a payment fails, a card is declined, and a subscription is cancelled. The user's access should change every time.
7. Your dependencies are up to date
AI tools happily install packages and never think about them again. Run your package manager's audit command (for example npm audit) and update anything with a known critical vulnerability.
8. Security headers and HTTPS
Your site should only load over HTTPS and send basic security headers. Free tools like securityheaders.com will grade your live site in seconds. Most hosting platforms let you add the missing headers in a few lines of configuration.
9. Backups exist, and you've restored one
Check that your database has automatic backups turned on. Then actually restore one to a test project. A backup you've never restored is a hope, not a backup.
10. You'll know when something breaks
Add error tracking and uptime monitoring before launch, not after your first angry email. You want to hear about a broken checkout from an alert, not from a customer.
What to do with the results
If you passed all ten, congratulations: you're ahead of most apps at this stage. If you failed some, fix them in this order: secrets, data access, payments, then everything else. The first three are the ones that leak data or money.
These ten checks are the Cosmerg Security Standard that every app we launch passes. If you'd rather have an engineer look, our free Preflight check reviews your live app from the outside and tells you what to fix first.