Built a Website or App with AI: Top 10 Security Checklist Steps Before Launch
The definitive pre-launch AppSec checklist for applications built with Cursor, Lovable, Bolt.new, or v0. Protect API keys, lock Supabase RLS, close database ports, and prevent data breaches.
The explosion of generative vibe-coding tools has unlocked superhuman development speed: non-technical founders and agile developers can now build full-stack web applications and SaaS platforms in Cursor, Lovable, Bolt.new, or v0.dev in a single weekend. However, LLMs write code optimized for instant visual gratification—systematically neglecting authorization boundaries, secret isolation, and database security.
Deploying an unvetted vibe-coded project to production almost guarantees that within 48 hours, automated reconnaissance bots will extract your private OpenAI or Stripe API keys from client JS bundles or dump your user database through open Supabase table policies. We've compiled the top 10 non-negotiable security checklist steps every founder must execute before launching.
1. Scan Client JavaScript Bundles for Embedded Private API Keys
The single most common flaw in AI-generated code is calling OpenAI, Stripe, or Resend directly from frontend React components with NEXT_PUBLIC_ or VITE_ prefixes. During build time, bundlers bake these secret tokens into static .js files, allowing anyone to inspect them in Chrome DevTools within seconds.
# Search codebase for leaked secret prefixes before running npm build:
grep -rn "sk-proj-" ./src
grep -rn "sk_live_" ./src
grep -rn "NEXT_PUBLIC_OPENAI" ./src
2. Lock Down Supabase & Firebase Row Level Security (RLS) Policies
Tools like Lovable and Bolt automatically scaffold PostgreSQL tables in Supabase. If RLS is left unconfigured or set to permissive public rules, anonymous attackers can send REST requests to your public Supabase URL and exfiltrate your entire customer table.
-- Enforce Row Level Security on the profiles table:
ALTER TABLE profiles ENABLE ROW LEVEL SECURITY;
-- Allow users to read only their own authenticated record:
CREATE POLICY "Users can only read own profile"
ON profiles FOR SELECT
TO authenticated
USING (auth.uid() = id);
3. Block Production Web Server Access to .env, .git, and Backup Files
When deploying to virtual private servers, developers often copy their working directory containing .env and .git directly into the web root. An improperly configured Nginx server will happily serve https://your-domain.com/.env to any automated crawler.
# Block all hidden files and version control directories in Nginx:
location ~ /\.(?!well-known) {
deny all;
access_log off;
log_not_found off;
return 404;
}
4. Close Public Database Ports (5432, 6379, 27017)
If hosting your own PostgreSQL, Redis, or MongoDB instance alongside your application, ensure these database services bind strictly to localhost (127.0.0.1) or internal Docker networks rather than 0.0.0.0.
5. Disable Production Source Maps in Bundlers
Source maps (.js.map) are invaluable during development, but deploying them to production exposes your complete original TypeScript source code, backend API endpoints, and business logic to competitors and adversaries.
// next.config.js
module.exports = {
productionBrowserSourceMaps: false,
};
6. Implement Rate Limiting on Authentication and LLM Endpoints
Exposing AI completion or authentication endpoints without rate limiting enables malicious actors to drain your OpenAI token credits or brute-force user credentials.
7. Audit Dependencies & Defend Against Hallucinated Packages
LLMs occasionally hallucinate npm package names. Threat actors register these hallucinated names on the npm registry and publish weaponized payloads. Always run package audits before deploying.
npm audit --audit-level=high
8. Deploy Hardened HTTP Security Headers (CSP, HSTS, X-Frame-Options)
Headers protect against clickjacking, XSS, and protocol downgrades. Ensure Strict-Transport-Security and Content-Security-Policy are active across your production environment.
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
9. Enforce Secure Cookie Flags (HttpOnly, Secure, SameSite)
User authentication session cookies must never be readable via client-side JavaScript. Enforcing HttpOnly and Secure flags mitigates session hijacking via XSS vulnerabilities.
10. Launch an In-Depth 24-Hour Non-Destructive Vulnerability Audit
The final and most dependable step is submitting your URL to Site Check. Our 24-hour non-destructive scanner analyzes 36 critical OWASP vectors and provides copy-paste prompt fixes tailored for your AI coding assistant.
Developer Security Checklist
- ✓ Audit frontend bundles for leaked OpenAI, Stripe, and Resend API secrets
- ✓ Verify that Row Level Security (RLS) is enforced across all database tables
- ✓ Confirm that .env, .git, and backup files return 404 on the public domain
- ✓ Ensure database ports (5432, 6379, 27017) are bound strictly to localhost
- ✓ Disable production source map generation in the build configuration
- ✓ Implement rate limiting on all public API and authentication routes
- ✓ Run npm audit to catch known vulnerabilities and hallucinated dependencies
- ✓ Configure HSTS, CSP, X-Frame-Options, and nosniff headers in Nginx
- ✓ Enforce HttpOnly, Secure, and SameSite flags on all authentication cookies
- ✓ Execute an in-depth 24-hour audit in Site Check to confirm zero attack surface
Security Auditor Synthesis & Key Takeaways
When shipping production web applications and vibe-coded projects built on modern stacks (Next.js, Astro, React, Supabase), perimeter security cannot be an afterthought. Over 85% of customer data leaks and database compromises do not stem from sophisticated zero-day exploits, but rather from trivial misconfigurations: orphaned staging endpoints, exposed environment files, overly permissive CORS policies, and disabled Row Level Security (RLS) rules.
Automated perimeter scanning with Site Check proactively catches these signatures across 36 critical attack vectors, equipping engineering teams and vibe-coders with immediate actionable remediation guides before automated scanning botnets discover the exposed endpoints.