Does this apply to apps built with Lovable, Bolt or v0?

Yes. Whatever tool built it, a public app needs the same checks. When the tool sets up the database or auth for you, look closely at how access control is configured.

Should I check even a small side project?

Yes. A leaked API key can be abused and billed to you even if you have few users, and a database misconfiguration leaks the data of everyone who signed up.

Security Checklist Before Launching an AI-Built App: 10 Things People Miss

By the IDEAVALU team · Updated 2026-10-29

AI-written code puts "it works" first, so where keys live and how data is protected often come later. Before launch, check three things above all: secret API keys never reach the browser, the database is not readable by strangers, and actions that need a login are protected on the server. This article lists ten items, those three included, with a way to check each.

10 things to check before launch

Ordered by how much damage they cause and how easily they are missed. The links explain how to check and fix each one.

Pre-launch security checklist for AI-built apps
Item	What to confirm	How to check
1. Secret API keys	No OpenAI, Stripe, service_role or similar keys in the browser JS	Search the build output, or run the IDEAVALU check
2. Database access control	Supabase RLS or Firebase security rules stop users reading or writing others' rows	List tables with RLS disabled using SQL
3. Server-side authorization	APIs and Server Actions that need a login also verify the user on the server	Call the API directly, signed out and without the UI, and confirm it is refused
4. Access to other users' data	Changing an ID in a URL or API call does not return someone else's data	Create two test accounts and try to open one account's data with the other's ID
5. Spending limits on external APIs	AI and other APIs have usage caps and per-user rate limits	Set caps in each dashboard, then call rapidly and confirm you get limited
6. HTTPS enforcement	http redirects to https and HSTS is set	Check the headers with curl
7. Security headers	Clickjacking protection, nosniff, Referrer-Policy and similar are present	Check the headers with curl
8. Session storage	Login cookies have Secure, HttpOnly and SameSite	Inspect cookies in browser developer tools
9. Dependencies	No packages with known vulnerabilities	Run npm audit and turn on GitHub Dependabot
10. Error pages and logs	Error pages and logs show no stack traces or secret values	In production, request a missing URL or send bad input and look at what is shown

Why AI-built apps have more of these incidents

AI writes code so the requested feature works. Ask it to "generate text with OpenAI" and you may get code that calls the API from the browser, shipping the key along with it. When it creates Supabase tables, it may stop at a working state without enabling RLS.

Everything looks fine on screen, so the person who built it rarely notices. Before launch, go through this checklist separately from your functional testing.

Ask your AI agent to check

You can ask a coding agent such as Claude Code or Codex to review the whole repository. Paste this prompt as is.

Prompt for a coding agent

Review this repository for security before launch. Do not change any code; list each problem with evidence (file and line).

1. Are secret API keys or tokens in code that reaches the browser, or in environment variables starting with NEXT_PUBLIC_ or VITE_?
2. Is Supabase RLS (or Firebase security rules) enabled on every table, so users cannot read or write other users' rows?
3. Do APIs and Server Actions that need a login verify the user and their permissions on the server?
4. Can changing an ID in a URL or API call read or change someone else's data?
5. Do calls to external APIs (AI and others) have rate limits or caps?
6. Do errors or logs expose secret values or stack traces?

Check the externally visible items in one scan

Items 1, 6, 7 and 8, plus email spoofing protection, can be checked by entering a URL into the IDEAVALU free security check. Items 2 to 5, 9 and 10 cannot be seen from outside, so check them with the methods above or with an AI agent.

FAQ

Does this apply to apps built with Lovable, Bolt or v0?: Yes. Whatever tool built it, a public app needs the same checks. When the tool sets up the database or auth for you, look closely at how access control is configured.
Should I check even a small side project?: Yes. A leaked API key can be abused and billed to you even if you have few users, and a database misconfiguration leaks the data of everyone who signed up.