Matt Turley, Continuum. Updated November 5, 2026.
The five checks, what you can test yourself in an afternoon, and what only a person reading the code will catch.
Check five things before real users arrive: who can read each table without logging in, whether a secret key sits in the browser code, whether one customer can reach another customer’s data, whether a payment leaves a matching order, and whether you can restore a backup. Any one failing means it is not ready. A free automated check covers the quickest of these.
AI tools build the screens that demo well and skip the dull protections underneath. These five are where launched apps most often fail, ordered by how much damage a failure does.
Open the live app in a private window and try to reach pages that should need a login. Make two test accounts, put a record in each, and see whether one account can see the other’s. Place a small real payment, then check that the order exists once.
None of that needs code. It will not find everything, but it finds the failures that hurt first, and it tells you whether a deeper review is worth paying for. The free launch checklist lists the rest of the items AI tools tend to skip, each linked to the vendor documentation.
A scan looks at your app from the outside, the way a stranger would. It cannot judge whether your business rules are right, whether a rare sequence of clicks double-charges someone, or whether an admin page checks who is asking. A clean automated result is a good sign and never a clean bill of health.
Exposure is common enough to be worth testing for. In our October scan of 500 live apps built with Lovable, Bolt and base44, 177 ran on Supabase, and 31 of those 177 had at least one table that answered a request made with no login. The full method and dataset are public.
If you take payments, store customer details, or have more than a handful of users, have someone who reads code look at it before launch. A Ship Check is $299: a written, honest read of the codebase and what it needs. If the read finds problems, Ship Fix is $4,000 to $15,000, quoted fixed.
Paste your live app URL and your email. A short automated check runs three public-security spot-checks and sends back one specific finding and what to do about it. It is free, and it is a preview, never a clean bill of health.
Run the free is-it-safe-to-ship check. Or book a call and talk it through.