Free tool

Pre-launch checklist for AI-built apps

18 checks to run before real users and real payments hit your Lovable, Bolt, Cursor, Replit, or v0 app. Progress is saved in this browser only.

Security

RLS is on for every table with user dataRun the pg_tables query from the RLS checklist; nothing user-scoped should show false. How No secret keys in the browser bundleSearch your built JS for sk_, service_role and whsec_. Only publishable or anon keys belong there. How Stripe webhooks verify signaturesThe handler checks the Stripe-Signature header against the raw body. How API routes check the sessionEvery server route that reads or writes user data confirms who the user is. How

Deploy

Production env vars are setEvery variable in your local .env has a value on the host, then you redeployed. How npm run build passes locallyThe same build your host runs succeeds on your machine. How Deep links work on refreshOpen a sub-page directly and refresh. No 404. How Custom domain and HTTPS workBoth the apex and www load over https.

Auth

OAuth redirect URLs include productionProvider console and Supabase URL configuration list your real domain, not only localhost or a preview URL. How Password reset and email confirm links point to productionSend yourself one of each and click it. A second test account cannot see the first account's dataSign in as two users and compare. How

Payments

Live mode keys and price IDs are in productionTest keys stay in development. How A real payment unlocks the accountRun one real low-value purchase and refund it. How Cancellations and failed renewals downgrade accessHandle subscription updated and deleted events, not only checkout completed. How

Reliability

Error tracking or logs you actually checkYou can see server errors from production. Rate limits on expensive endpointsAI calls, emails and sign-ups cannot be spammed. Database backups are onKnow how you would restore yesterday's data. A rollback pathYou can redeploy the previous version in one step.