Matt Turley, Continuum. Updated November 5, 2026.
For founders a week or two from opening an app to real users, built mostly with tools like Lovable, Bolt, Cursor, Replit or v0.
Check what a stranger can reach, not what you can. Before launch: test sign-up as a new user, confirm no user can read another's data, make sure no secret is in the browser code, run a real payment end to end, check that emails arrive, set up backups and monitoring, and know how to roll back.
AI builders produce an app that looks finished long before it is safe to launch. They are strong at screens and flows, and weak at the things nobody sees until they fail: who can read which rows, what happens when a payment webhook is missed, whether the email actually arrives.
A pre-launch check is therefore not a polish pass. It is a deliberate attempt to break the app as a stranger would, on the real domain, with real configuration. The aim is to find the five things that would hurt most, not every flaw.
The checks below are in the order of harm. A leaked key or open table can end the business; a slow page cannot.
How to tell Sign in as user A, then request user B's records by changing an id in the URL or API call. Check row level security or the server-side checks that stand in for it.
The fix Enforce ownership on the server or in database policies for every table and file bucket, not in the interface. Our page on Supabase RLS goes through the checks.
How to tell Search the built JavaScript and the page source for API keys, service role keys and tokens. Anything prefixed to be public ships to every visitor.
The fix Move secrets to server-only code, rotate any that were exposed and keep them out of the repository history.
How to tell Test mode working is not live mode working. Webhook endpoints, signing secrets and products are separate in each mode.
The fix Make one real small purchase, confirm access is granted by the webhook, refund it and confirm the refund is handled. Our page on Stripe webhooks lists the usual faults.
How to tell Sign up with an email and a social account you have never used on the app, confirm the email arrives, reset a password and sign out and in again on another device.
The fix Fix redirect URLs, the email sender and the callback route, and add rate limiting on login and reset.
How to tell An endpoint that costs you money (AI, email, SMS, storage) with no login or limit is a bill waiting to happen.
The fix Require login for costly calls, rate limit per user and per address, and set spend caps and alerts at each provider.
How to tell You cannot say when the last backup ran, you have never restored one, and you would learn of an outage from a customer.
The fix Enable database backups and test a restore, add error tracking and an uptime check, and learn how to roll back a deployment before you need to.
A simple app with no payments and no personal data can be checked by its founder in a day using this list. A written independent read is worth it when users will entrust you with data or money and nobody who knows security has seen the code.
The free Leak Check tests the live URL from outside in under a minute: reachability, SSL, auth flow, payment path, exposed secrets and Supabase exposure. A Ship Check goes into the code behind it and returns a written verdict in 48 hours.
free Leak Check: Paste your live URL. It runs seven surface checks (reachability, SSL, auth flow, payment path, exposed secrets in the client bundle, Supabase exposure, broken links and performance) and returns a green, yellow or red for each. It is a surface scan, not a full security audit. Or: Get a Ship Check, $299.