You built an app over the weekend with Lovable, Bolt, Replit, or Cursor. The demo looks slick, the features work, and you are ready to share the link. But before you hit send, stop. AI coding tools excel at making things functional, but they often fail at making things secure because security is invisible in a demo. A new guide from selfhostcalc on DEV.to outlines a critical 10-step pre-launch security checklist specifically designed for these AI-generated codebases.

The Secret Key Trap

The most immediate danger is leaking secrets in your front-end bundle. In Vite projects, any variable prefixed with VITE_ ends up in the JavaScript bundle, while Next.js exposes anything starting with NEXT_PUBLIC_. If you have a Stripe secret key, an OpenAI key, or a Supabase service_role key sitting behind these prefixes, anyone can copy it. The guide advises opening your deployed site, viewing the source, and searching the JavaScript files for strings like sk_, service_role, and api_key. If you find a real secret, rotate it immediately and move the API call to a server function.

Database and User Isolation

For Supabase users, the anon key is meant to be public, but this is only safe if Row Level Security (RLS) is active on every table in the public schema. Run a specific SQL query to find tables where rowsecurity is false; if any exist, anyone with your public key can read them. Furthermore, the guide highlights a subtle logic flaw: checking if a user is logged in is not the same as checking if they are the owner. The most common leak in AI apps is a policy that allows User B to read User A's data just because both are authenticated. You must create two test accounts and verify that User B cannot fetch User A's rows.

Payments and Webhooks

Never trust a redirect URL to confirm a payment. Anyone can manually type a 'thank you' page URL to bypass payment checks. Instead, rely strictly on the provider's webhook, verify the signature on every event, and ensure the handler is idempotent so retries do not grant double access. This step is critical because automated external checks cannot verify your business logic, meaning you must manually confirm that payment states are handled securely.

Infrastructure and Headers

Basic infrastructure hygiene is often overlooked in AI-generated apps. Ensure .env files, .git/config, and unintended source maps are not publicly accessible by visiting their paths and confirming they return a 404 or are blocked. Additionally, force HTTPS and add essential security headers like Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, and a frame policy. These settings can be configured directly in Vercel or Netlify config files, providing a necessary layer of defense against common web vulnerabilities.

Key Takeaways

  • Rotate any secret keys found in your front-end JavaScript bundle immediately.
  • Verify Row Level Security (RLS) is enabled on all Supabase tables and test ownership policies with two distinct user accounts.
  • Confirm payments via webhooks and signatures, never via client-side redirects.
  • Block access to .env, .git, and source maps while enforcing HTTPS and security headers.

The Bottom Line

Automated tools can scan the outside of your app, but they cannot judge your business logic. The most dangerous vulnerabilities in AI-built apps require manual testing, so do not skip the steps that require you to click through your own product.