Free Download
The checks AI tools and fast-moving founders consistently miss before launch
47 production checks built from real post-mortems on AI-built apps. Not a generic checklist — the specific things that break when you ship with Cursor, Lovable, Bolt, or Replit.
What this catches
These patterns come up in nearly every AI-built app we review.
API keys hardcoded in client-side code
Common in Lovable and Bolt projects — keys end up in the browser bundle and are visible to anyone.
Database rows accessible without auth checks
Common in Supabase + AI-generated queries — row-level security is off by default, and AI tools rarely turn it on.
Webhook endpoints that accept any payload
AI-generated Stripe integrations almost never verify webhook signatures. Easily spoofed to trigger fake events.
Rate limiting missing on login endpoints
No limit on failed login attempts means your auth endpoint is a wide-open brute force target.
Environment variables leaking into client bundles
Next.js and Vite have specific rules about what gets exposed. AI tools get this wrong more often than not.
What's inside
Security
API keys, auth flows, exposed endpoints
Database
Row-level security, backups, connection security
Payments
Webhook verification, price manipulation guards
Performance
Query optimization, caching, load testing
Error Handling
Graceful failures, logging, alerting
Environment
Secrets management, prod vs dev config
Get the checklist
Free. Sent to your inbox immediately.
A few items from the list
Want a developer to run this for you?
The checklist is the DIY version. Vibe Rescue is the done-for-you version.
See Vibe Rescue