What to check before launching a Cursor, Lovable or Bolt app

Whether you built with Cursor, Lovable, Bolt, v0 or another AI tool, the same handful of issues tend to show up. Spend an hour on these before you share the link.

1. Secrets

Search the repo and its history for API keys (gitleaks does this). Make sure only publishable keys are in frontend code, and rotate anything that leaked. See how to check for leaked API keys.

2. Your database

Lovable and Bolt projects frequently use Supabase. The anon key is in your frontend by design, so Row Level Security is the only thing stopping a visitor from reading or editing every table. Open the Supabase dashboard, check every table has RLS enabled, and review each policy.

3. Try to break your own app

• Log out and call your API routes directly (from the browser console or curl). Do they refuse?
• Log in as one user and try to load another user's record by changing an ID in the URL.
• Change a price or role in a request and see whether the server accepts it.

4. Dependencies and build

Run npm audit and update your framework to its latest patch release (see fixing npm audit in plain English). Make sure the production build passes with type checks on.

5. Payments and email

Verify Stripe (or other) webhook signatures, test a full checkout in test mode, and send yourself every transactional email.

6. Basics

• Custom domain with HTTPS.
• Privacy policy and terms if you collect data or take money.
• A way for users to contact you.
• Error tracking or at least logs you know how to read.

For the full list, see the security checklist for vibe-coded apps.

Automated checks and general guidance, not a substitute for a professional security audit.

All guides · Home · Terms · Privacy