Ship It Safely: 5 free pre-launch checks

Built your app with Lovable, Bolt, Replit, v0, Base44 or Cursor? Catch the common pre-launch mistakes before your users do. Here are five checks from our pre-launch kit, free. Each one links to the vendor's own docs.

Run your builder's own security scan first. These checks cover things a clean scan doesn't prove.

1. Row Level Security is on for every tableDatabase access rules

In Supabase, open Database > Tables and confirm RLS is enabled on every table in public (and any other schema your API exposes). Then check each table has a policy per action that limits private rows to their owner.
Why: Supabase's production checklist says tables without RLS and reasonable policies let any client read and change them. On Base44, check each table's Permissions: Base44 says All Users means "anyone can perform this action, even without signing in".

Source: Supabase production checklist · Base44: managing data permissions
2. No secret key ships to the browserAPI keys & env vars

No secret uses a VITE_ or NEXT_PUBLIC_ name. Build the app and search the output folder for secret prefixes such as sb_secret_, service_role, sk_live_ and whsec_.
Why: Vite says VITE_* values "are bundled into your source code at build time" and "should not contain sensitive information such as API keys". Supabase calls its secret key "server-only".

Source: Vite env docs · Next.js environment variables · Supabase API keys
3. Sign-up emails can actually be sent on launch daySign-in & sessions

Set up a custom SMTP provider for auth emails from your own domain, then raise the limits under Authentication > Rate Limits before you announce.
Why: Without custom SMTP, Supabase limits its email-sending auth endpoints (sign-up, password recovery, email change) to 2 emails per hour.

Source: Supabase production checklist · Supabase auth rate limits
4. Buckets holding user files are privateFile uploads & storage

List your storage buckets. Anything holding documents, receipts, IDs or exports is Private and served with short-lived signed links. Only truly public content (marketing images, public avatars) sits in a public bucket.
Why: In a Supabase public bucket "anyone who possesses the asset URL can readily access the file". Bolt says of its public buckets: "Anyone with the link can see these files, even if they're not signed in to your app."

Source: Supabase buckets · Bolt file storage
5. Paid access comes from a verified webhook, not the success pagePayments & webhooks

Your server grants paid access, credits or downloads when it receives a verified payment event, not when the browser reaches a "thank you" page.
Why: Stripe says "You can't rely on triggering fulfillment only from your checkout landing page, because it's not guaranteed customers visit that page".

Source: Stripe: fulfil orders

The full kit: Ship It Safely – Security Checklist Kit

Get the full kit — US$19 Also on Gumroad

Price in US dollars; each platform works out any tax at checkout. Not useful? Email us within 14 days of purchase for a full refund, no questions asked. This doesn't affect your rights under the Australian Consumer Law.

8 sections and 153 checks: database access rules, API keys, sign-in, file storage, rate limits and cost abuse, payments and webhooks, privacy and legal basics, and launch SEO and analytics.
40 copy-paste fix prompts for Lovable, Bolt, Replit, v0, Base44 and Cursor. Each one audits first and asks for a plan before changing anything.
A stack-cost sheet with sourced, dated prices for the 33 AI coding tools we track, as a PDF appendix and a CSV.
Every check links to the official docs it's based on, with the date we checked it.

Read this first

Ship It Safely – Security Checklist Kit is a checklist, not a security audit, a penetration test or legal advice. Working through it doesn't guarantee your app is free of vulnerabilities. If your app handles payments, health, financial or children's data, or anything sensitive, get a professional review before launch. Vendor docs change: if a linked page and this checklist disagree, the vendor's current docs win. Lovable, Bolt, Replit, v0, Base44, Cursor, Supabase and Stripe are trademarks of their owners; VibeLedger isn't affiliated with or endorsed by them.