Built it with AI? Let’s make it safe to launch.

Go through these yourself. If more than two are “not sure”, an audit will pay for itself. For a quick start, the free app safety check finds exposed keys, public source maps and a readable .env or .git in about half a minute.

1. 01Row-level security is on for every tableIn Supabase, a table without RLS policies can be read or changed by anyone holding your public anon key — which ships in your frontend.
2. 02No service-role or secret key in the browserSearch the built JavaScript for your service-role key, Stripe secret key and any API key that should stay on the server.
3. 03Secrets are not in Git historyA key deleted in a later commit is still in the history. Rotate it, then remove it from the repo.
4. 04Every API route checks who is askingGenerated endpoints often trust an ID from the request. Try fetching another user’s record by changing the ID.
5. 05Payments are confirmed by webhook, not the browserMark an order paid only when a signed webhook from Stripe says so — never because the checkout page redirected back.
6. 06Sign-in and sign-up are rate limitedWithout limits, one script can try thousands of passwords or create thousands of accounts.
7. 07Input is validated on the serverClient-side checks are for convenience. The server must reject bad data on its own.
8. 08Backups exist — and one has been restoredA backup you have never restored is a hope, not a backup. Restore one into a scratch database.
9. 09Production and test data are separateExperiments and seed scripts should never run against your live database.
10. 10Errors reach you before users doUptime checks and error alerts, so you hear about an outage from a tool rather than a customer.
11. 11Dependencies have no known advisoriesRun npm audit (or your stack’s equivalent) and fix high-severity issues before launch.
12. 12Logs don’t store passwords or personal dataGenerated code often logs whole request bodies. Check what ends up in your logs.