AI-Built App Launch Checklist

Before an app built with Lovable, Replit, Bolt, v0 or Cursor meets real customers: secrets, data rules, ownership, failures and safe change.

20 checks60 minutes

From the guide Your AI Built the App. Before Real Customers Use It, Check These Five Things

AI tools build the happy path well and leave the gaps nobody asked about. These checks close the gaps in the order an attacker, or a bad Tuesday, would find them.

01Secrets and keys

Search the browser bundle for secret keys (sk_live_, sk-, AKIA, service_role)Anything the browser downloads, anyone can read, and AI tools often paste server keys into front-end code.
Rotate every exposed secret, move it to the host's environment variables, then revoke the old keyMoving a key without revoking it leaves the old one working for whoever already copied it.
Check the repository history for keys that were ever committedA secret stays in git history after the file changes, and history is what gets cloned.
Set spending limits on every AI and API accountA leaked or abused key should hit a ceiling, not your card.

AI-Built App Launch Checklist

01Secrets and keys

02Who can see what

03What you own

04When it fails

05Safe to keep changing

The rest of the kit is one step away.