The vibe-coded app launch checklist

AI builders get you to a working demo fast. Launch day is different: real users, real data, bots probing your endpoints, and a bill tied to your API keys. This checklist covers what AI-generated apps most often miss. Work through it top to bottom. Items near the top cause the worst incidents.

1. Secrets and API keys

• No private keys in frontend code. OpenAI, Anthropic, Stripe secret, database URLs and Supabase service_role keys must live on the server (API routes, Edge Functions). Anything prefixed NEXT_PUBLIC_ or VITE_ is shipped to every visitor.
• No .env in git. Add .env* to .gitignore and commit a .env.example with placeholder values.
• Rotate anything that ever leaked. Git history and old deployments keep secrets forever. See how to check and rotate exposed keys.
• Set spending limits on OpenAI, Anthropic and other usage-billed APIs, so a leak costs dollars and not thousands.

2. Database and authorization

• Row Level Security on every table (Supabase) or locked-down Security Rules (Firebase). Test by requesting another user's record while signed in.
• Server-side authorization. Hiding a button is not access control. Every API route checks who is calling and what they may touch.
• Private storage buckets for user uploads, served with signed URLs.
• Input validation on the server, for example with zod, for anything that writes data.
• Backups enabled and a restore you have actually tried once.

3. Authentication

• Auth redirect URLs restricted to your real domains.
• Email verification and password rules chosen on purpose.
• Rate limiting or CAPTCHA on sign-up, login, password reset and any endpoint that costs you money (AI calls, emails, SMS).

4. Transport and headers

• HTTPS everywhere, with HTTP redirecting to HTTPS.
• Security headers: CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy. Copy-paste configs for Vercel and Netlify.
• CORS on your API restricted to your own origins, not * with credentials.

5. Build and deploy hygiene

• A clean install and build passes: rm -rf node_modules && npm ci && npm run build.
• Lockfile committed (package-lock.json, pnpm-lock.yaml or bun.lockb).
• Production environment variables are set in your host's dashboard, not only on your laptop.
• npm audit reviewed for high or critical issues in dependencies you actually use.
• Debug routes, test accounts, seed data and verbose console.log calls removed.

6. Performance

• Mobile PageSpeed score checked, with Largest Contentful Paint under 2.5 s. See how to fix slow LCP.
• Images compressed and sized (WebP or AVIF, explicit width and height).
• No multi-megabyte JavaScript bundle on the landing page.

7. SEO and sharing

• A unique <title> and meta description on each page.
• Open Graph tags and an image, so links look good when shared.
• Pages that render real HTML, or at least prerendered landing pages, so search engines and AI crawlers can read them.
• robots.txt and sitemap.xml in place, and no leftover noindex from staging.
• No broken links or 404s in navigation.

8. Legal and trust

• A privacy policy that says what you collect and which processors (OpenAI, Supabase, Stripe) see the data.
• Terms of service, especially if you take payments or host user content.
• A cookie banner if you use non-essential cookies with EU or UK visitors.
• A contact email that actually reaches you.

9. Monitoring

• Error tracking (Sentry or your host's logs) so you hear about crashes before users tweet them.
• Uptime monitoring on the homepage and your key API route.
• Billing alerts on every cloud and AI provider.

Automate the outside-in part

A lot of this list can be checked from the outside in seconds. ShipCheck is a free, passive scanner built for vibe-coded apps. Paste your live URL or public GitHub repo and it checks for leaked keys and committed .env files, HTTPS, security headers, broken links and mobile speed, then gives you copy-paste fixes. It won't replace testing your access rules by hand, but it catches the embarrassing stuff before your users do.