Scan free
Guides

What to check before launching a Cursor, Lovable or Bolt app

Whether you built with Cursor, Lovable, Bolt, v0 or another AI tool, the same handful of issues tend to show up. Spend an hour on these before you share the link.

1. Secrets

Search the repo and its history for API keys (gitleaks does this). Make sure only publishable keys are in frontend code, and rotate anything that leaked. See how to check for leaked API keys.

2. Your database

Lovable and Bolt projects frequently use Supabase. The anon key is in your frontend by design, so Row Level Security is the only thing stopping a visitor from reading or editing every table. Open the Supabase dashboard, check every table has RLS enabled, and review each policy.

3. Try to break your own app

  • Log out and call your API routes directly (from the browser console or curl). Do they refuse?
  • Log in as one user and try to load another user's record by changing an ID in the URL.
  • Change a price or role in a request and see whether the server accepts it.

4. Dependencies and build

Run npm audit and update your framework to its latest patch release (see fixing npm audit in plain English). Make sure the production build passes with type checks on.

5. Payments and email

Verify Stripe (or other) webhook signatures, test a full checkout in test mode, and send yourself every transactional email.

6. Basics

  • Custom domain with HTTPS.
  • Privacy policy and terms if you collect data or take money.
  • A way for users to contact you.
  • Error tracking or at least logs you know how to read.

For the full list, see the security checklist for vibe-coded apps.

Check your app now, free

Paste a GitHub repo or your live app's URL. You get a free score in under a minute, with no signup. The $19 Full Report gives a copy-paste AI fix for each issue found, and you get a full refund if the scan fails.

Only scan repos and sites you own or are authorized to test. See our Terms.

No signup · read-only · we never keep your code. How we handle your code

No signup. We only read. We never run your code or attack your site. We never keep your code, only your report. Reports are saved so you can track progress over time. Delete anytime on request. See the leaderboard

Full Report: $19See a sample report

General guidance. A fast automated check for the most common security mistakes in AI-built apps. Not a substitute for a full security audit. Updated 2026-10-19.

All guides · Home · Terms · Privacy