Vibe-Coded App Production Checklist: 12 Steps Before You Launch
By ExcenityAI · Published · Updated
To make an app built with Lovable, Cursor, Bolt, Replit or a similar tool production-ready, lock down secrets, login checks and database rules, put hard spend caps on every paid API, then add monitoring, backups and a tested way to roll back. The twelve steps below take most apps a few days, and the first five matter most because they stop data leaks and surprise bills.
Why does an AI-built app need a checklist?
AI app builders are very good at making something that works on your screen. They are much less reliable at the parts nobody sees: who is allowed to read which row, where a secret key lives, and what happens when a bot hits your endpoint 50,000 times.
A prototype can get away with that. An app with real users, real data and a credit card behind its AI keys cannot. This checklist covers the gap. Each step links to a deeper guide where one exists.
Steps 1 to 5: stop leaks and unauthorized access
1. Move every secret out of the frontend
Anything shipped to the browser can be read by anyone. Search your code and built bundle for strings that look like keys. Variables with prefixes such as NEXT_PUBLIC_ or VITE_ are public by design, so never put an OpenAI, Anthropic, Stripe secret or database admin key in one. Call paid APIs from a server route instead, and rotate any key that was ever exposed.
2. Check the git history, not just today's code
A key you deleted last week is still in the history. Rotate it. Removing it from the file is not enough.
3. Add authentication and authorization to every route
Authentication asks who you are. Authorization asks whether you may do this. Test the second one by logging in as user A and requesting user B's record by changing an ID in the URL or request. If it works, you have a hole.
4. Turn on database access rules
On Supabase, enable Row Level Security on every table in an exposed schema and write policies. On Firebase, replace test-mode rules with rules that check request.auth. See our Supabase RLS guide.
5. Close open storage buckets
Check every bucket for public listing and public write. Make user files private by default and serve them through signed, expiring links.
Steps 6 to 8: stop surprise bills
6. Set hard spend limits on every AI provider
Alerts tell you after the money is gone. A hard limit stops requests. Set one on OpenAI and Anthropic and keep a separate project or workspace for each app. The exact steps are in our guide to capping OpenAI, Claude and cloud API bills.
7. Add budgets and anomaly alerts on your cloud and host
AWS Budgets, AWS Cost Anomaly Detection, Google Cloud budgets and Vercel Spend Management all send alerts. Most of them are alerts, not caps, and some report with a delay of hours, so treat them as a second layer.
8. Rate-limit anything that costs money or sends messages
Limit sign-ups, password resets, email and SMS sending, and every route that calls an AI model. Limit per user and per IP, and put a maximum on tokens per request.
Steps 9 to 12: keep it running
9. Separate development and production
Use different databases, keys and environment variables for each. Never test against live customer data.
10. Turn on backups and test a restore
A backup you have never restored is a hope, not a backup. Restore into a scratch project once and time it.
11. Add error tracking, logs and uptime checks
You need to find out about a failure before your users tell you. Add error tracking, structured logs without secrets in them, and an uptime check on the main page and the main API route.
12. Have a rollback and an incident plan
Know how to revert to the last working version in a minute, how to rotate every key, and who you call. Write it down on one page.
In what order should you do it?
- Today: steps 1, 2 and 6. Rotate exposed keys and cap your AI spend.
- This week: steps 3, 4, 5 and 8. These close the data and abuse holes.
- Before launch: steps 7 and 9 to 12.
If you would rather not do this alone, the free AI App Security & Cost Audit call covers steps 1 to 8 with you, and our AI-built app service can do the fixes.
Frequently asked questions
Is a vibe-coded app safe to launch as it is?
Not without checking. AI tools often leave secrets in client code, skip authorization checks or leave database and storage rules open. Run the first eight steps of this checklist before real users or real money are involved.
How long does hardening an AI-built app take?
For a small app, the highest-value steps (secrets, access rules and spend caps) typically take a few days. Larger apps with many tables or integrations take longer. It depends on the app, so treat this as a rough guide.
Can I ask the AI tool to fix these issues for me?
It can help with specific fixes, but it will not reliably find what it missed in the first place. Verify each fix yourself: log in as a second user, try to read the first user's data, and search the built bundle for keys.
What is the single most important step?
Keeping paid secret keys out of the browser and setting hard spend limits. Those two prevent the most expensive and fastest failures.
Sources
Checked 27 Oct 2026. Provider settings and limits change, so confirm against the linked documentation.