A pre-launch security checklist for apps built with Lovable, Bolt and Cursor

Building an app in a weekend with Lovable, Bolt, Replit or Cursor can be exciting, but safety should not be overlooked. This checklist ensures your AI-built app is secure before real users access it. First, search for secrets in the front end. Anything downloaded by the browser is public, so look for variables starting with VITE_ or NEXT_PUBLIC_ that might contain Stripe keys, OpenAI keys, or Supabase service_role keys.

Replace any found secrets and move calls to server functions. Next, check the database from outside. For Supabase, ensure Row Level Security (RLS) is enabled for all public tables with strict policies. Test as a second user by creating two accounts, logging in as each, and attempting to fetch the other's data. If unauthorized access occurs, tighten policies.

Avoid leaving files such as env variables, .git/config, and backup files accessible. For payments, trust webhooks over redirects, verify signatures on events, and make handlers idempotent. Configure auth settings to use your real domain instead of a wildcard, and test password resets and confirmations. Implement rate limits on signup, login, password reset, and any endpoint sending emails or making paid API calls.

Force HTTPS and add security headers like Strict-Transport-Security, Content-Security-Policy, and X-Content-Type-Options. Test your app as a second user by signing up, logging in, resetting a password, making payments, deleting an account, and opening every page. Finally, enable database backups and test a restore, ensuring your code is backed up in Git before each major AI change.

While this checklist does not replace penetration testing, following these steps helps identify common security issues before they affect real users.