Milo Kits
Guide

Lovable, Bolt, Replit and v0 app security checklist before launch

By Milo Kits · Updated

Before you share an AI-built app, check six things: no secret keys in the frontend, database rules that stop strangers reading other people's data, real server-side checks on logins and admin pages, payments that the server (not the browser) controls, no stray files like .env on the live site, and basic security headers. Most of these take minutes to check and one prompt to fix. The checklist below covers apps built with Lovable, Bolt, Replit, v0, Cursor or Claude Code, whatever the backend (Supabase, Firebase or your own API).

AI coding tools are good at making things work, and less reliable at locking them down. Lovable itself now runs a security scan before publishing and says it blocks "around 1200 private API keys from being directly inserted in code per day" (Lovable blog). That figure is a good sign that this is a common mistake, and a reason to check for yourself.

1. Secrets: nothing private in the browser

2. Database: strangers can't read other people's rows

3. Sign-in and roles: enforced on the server

4. Admin and debug pages: not just hidden

5. Payments: the server decides the price

6. Files, headers and HTTPS

Copy-paste prompts for your AI coder

Whole-app review (run this first)
Act as a security reviewer for this app before launch. Check and report, with file paths: 1. Any secret (API keys, service_role / sb_secret_ keys, Stripe sk_ keys, private keys) that is reachable from client code or a VITE_ / NEXT_PUBLIC_ / REACT_APP_ env var. 2. Every database table or collection: who can read and write it when logged out, and whether one signed-in user can access another user's data. 3. Every API route and page that should require login or an admin role, and whether that check happens on the server. 4. Payment flows: is the price decided on the server, and does the webhook verify signatures? 5. Missing security headers and any debug routes, source maps or .env files in the production build. List findings as Fix first / Fix soon / Nice to have. Don't change code yet.
Server-side admin protection
/admin and /api/admin/* are only protected by hiding links in the UI. Please add a server-side check that the current user has an admin role (from the database or auth metadata, not localStorage) on every admin route and API, redirect non-admins away from /admin before it renders, return 403 from admin APIs for everyone else, and show me how to test it with a normal account.
Payments
Review my Stripe integration. Make sure: prices and plan IDs are chosen on the server from an allowlist (never from the request body), only the publishable key is in client code, the webhook verifies the Stripe signature with the signing secret, and a user's plan only changes in response to a verified webhook event. Show me the diff for anything that needs fixing.

After you fix things

Re-check after every big AI change. Tools can quietly undo a fix while "helping" with something else. A two-account test (user A, user B) is the single most useful habit.

FAQ

Are apps built with Lovable or Bolt secure by default?

They can be, but it depends on how the database rules, secrets and auth checks were generated and edited. Platform scans help, but they don't know your business logic, so you still need to check who can read which data, and make sure no secret keys reach the browser.

What's the most common security problem in vibe-coded apps?

Broken access control: database tables or API routes that let a logged-out visitor, or one user, read or change other users' data. Missing Supabase RLS policies and open Firebase rules are the classic examples, followed by secret API keys shipped in frontend JavaScript.

How long does a pre-launch security check take?

Working through this checklist yourself takes an afternoon for a typical small app. Most fixes are one prompt to your AI coder plus a quick re-test.

Do I need a penetration test before launch?

For a small app without sensitive data, a careful checklist like this one covers the most common problems. If you handle health, financial or other sensitive data, or significant payments, get a professional penetration test as well.

Can I ask my AI coding tool to secure the app for me?

Yes, and it's a good start: use the review prompt above. But verify the result yourself with logged-out and second-user tests, because AI tools can miss issues or report a fix that doesn't work.

Sources

This guide is general information, not a security audit. Platforms change, so check the linked docs for current details. Spotted something out of date? Email hello@milokits.com.

More guides