Guides
Launch checklists for apps built with AI tools: what to check, why it matters and how to fix it.
How to secure a Lovable app before you launch
A launch checklist for Lovable apps: Supabase row level security, secrets, server-side paywalls, Lovable’s own security scan and what it does not cover.
ReadSupabase row level security checklist for AI-built apps
Ten checks that stop the most common Supabase data leaks: RLS on every table, safe policies, views, functions, storage buckets and the service_role key.
ReadHow to check if your website leaks API keys
Which keys are safe in the browser, which are not, how to find a leaked key in your deployed JavaScript, and what to do in the first hour after you find one.
ReadSecurity checklist for Next.js apps built with Cursor or Claude Code
Auth checks in route handlers and server actions, environment variables, webhooks, AI endpoint limits and headers for Next.js apps written by an AI agent.
ReadHow to secure an app built with Bolt.new
Bolt apps are usually Vite and React with Supabase. Here is what to check before you publish: VITE_ variables, RLS, server-side logic and the live site.
ReadHow to secure an app built on Replit
Secrets, public code, deployments, databases and auth for apps built with Replit Agent, plus what to check on the live URL.
ReadHow to secure an app built with v0
v0 generates Next.js apps you deploy on Vercel. Check environment variables, server actions, preview deployments, database rules and headers before launch.
ReadSecure Stripe and Paddle payments in an AI-built app
Verify webhook signatures, take prices from the server, grant access from webhooks not redirects, and keep secret keys server-side.
ReadHow to stop people running up your AI API bill
Auth, per-user rate limits, input caps, spending limits and key handling for apps that call OpenAI, Anthropic, Gemini or other AI APIs.
ReadHow to monitor signup, login and checkout after every deploy
Why AI-assisted changes break critical flows silently, which flows to watch, and how to set up checks that run on a schedule and after each deploy.
Read