Milo Kits
Free PDF · 2 pages

Pre-launch security checklist for AI-built apps

14 checks to run before you share your link, written for apps built with Lovable, Bolt, Cursor, Claude Code, Replit or v0. Each check comes with a prompt you can paste straight into your AI coder.

Get the checklist (PDF)

Enter your email and the download link appears straight away.

You'll get the PDF on the next page, and you'll be subscribed to Ship It Safe, our free security tips email (at most one a week). Unsubscribe anytime with the link in every issue. Privacy.

What's on the list

  1. No secret keys in your frontend. Anything in your JavaScript bundle is public. OpenAI, Stripe secret, Resend, database and service_role keys must only live on the server.
  2. Supabase: Row Level Security on every table. The anon key is meant to be public. RLS is what stops strangers from reading or changing your data with it.
  3. Firebase: rules aren't in test mode. "allow read, write: if true" (or a test-mode date rule) lets anyone read or wipe your database.
  4. Admin pages and API routes check auth on the server. Hiding a button isn't protection. The route itself must refuse logged-out users and non-admins.
  5. No .env, .git or backup files on your live site. Exposed .env or .git folders hand out your keys and source code.
  6. Source maps aren't public (or contain nothing sensitive). Public .map files rebuild your original source code, including comments and internal URLs.
  7. HTTPS everywhere, with HSTS. http:// should redirect to https://, and HSTS tells browsers never to use plain HTTP.
  8. Security headers set. A Content-Security-Policy, frame protection, X-Content-Type-Options and Referrer-Policy block whole classes of attacks.
  9. CORS isn't wide open on private APIs. Access-Control-Allow-Origin: * with credentials, or reflecting any origin, lets other sites call your API as your users.
  10. Rate limits on forms, logins and AI endpoints. Without limits, bots can spam your forms, guess passwords and run up your AI bill.
  11. Storage buckets aren't publicly listable. Public buckets often hold user uploads, invoices or IDs that were never meant to be shared.
  12. Error pages don't leak details. Stack traces, SQL errors and debug pages show attackers your stack and internals.
  13. Payment webhooks verify signatures. An unverified Stripe or Lemon Squeezy webhook lets anyone fake a "paid" event.
  14. Cookies and sessions are locked down. Session cookies should be Secure, HttpOnly and SameSite so scripts and other sites can't grab them.

Want the detail now? The full pre-launch checklist guide covers the same ground with sources, and the guides go deeper on Supabase keys and RLS, API keys in the frontend and security headers.

General guidance, not a security audit or penetration test. Want a second opinion on your live app? Get a free automated top 3, or a human-checked report from $29.