Is your vibe-coded app safe to launch? A production-readiness checklist

AI builders like Lovable, Bolt, Cursor and Replit get you most of the way to a working app astonishingly fast. The problem is the last 20% — the part that decides whether you’ve shipped a product or a liability.

We’ve reviewed enough AI-built apps to know what breaks. Here’s the checklist we run before we’d let one go live.

Security

• Secrets and API keys — none hard-coded in client-side code or build logs. Move them server-side or behind a proxy.
• Row-level security — if you’re on Supabase or Firebase, RLS is configured and tested, not left open.
• Authentication — sessions, OAuth or JWT implemented properly, not faked in the frontend.
• Input validation — every field and endpoint checked against the OWASP Top 10 (SQL injection, XSS, RCE).
• Access control — try to reach every page and endpoint while logged out. If you can, so can an attacker.

Data

• Know exactly where user data lives and who can reach it.
• Automated backups exist and have been restored at least once.
• Sensitive data isn’t leaking through API responses or logs.

Reliability

• Rate limiting before someone burns your API bill.
• Error tracking and monitoring so you find out before your users do.
• A real dev/staging/production split — not editing live.

The honest part

Most of this is invisible until it fails, which is exactly why AI builders skip it and why founders don’t notice until it’s a problem. AI can write the code. Making it safe to ship is still engineering.

If that list made you nervous, that’s what our Vibe-Code Rescue service is for — we fix it and get you live.