AI coding tools get you to a working app fast. They are less good at the unglamorous parts that decide whether it is safe to put in front of real users. Before I launch anything built with Cursor, Lovable, Claude or ChatGPT, I check the same four things.
1. Exposed keys and secrets
API keys have a habit of ending up in the repo: pasted into a config file to "just get it working", committed, and forgotten. Search the whole repo, including old commits, for anything that looks like a key, token or connection string. If a secret has ever been committed, treat it as leaked and rotate it. Deleting the line is not enough, because it stays in the history.
2. Open databases
A database that works in development is often wide open: no row-level rules, public read access, or a default admin account. Check who can read and write each table or collection when you are not logged in at all. If the answer is "anyone", fix it before launch.
3. Missing auth checks
It is easy for the page to hide a button while the API behind it still answers anyone. For every endpoint that changes or returns user data, confirm the server checks who is asking, and that they are allowed to see that record, not just that they are logged in.
4. Payment bugs
Check that prices and amounts are decided on the server, not trusted from the browser. Confirm that a payment is only treated as successful when your payment provider's webhook says so, and that a failed or repeated webhook cannot give someone free access or charge them twice.
Make it a habit
Do this by hand once so you know what you are looking for, then make it routine. Keep secrets in environment variables, never in the repo. Add a secret scanner to your CI so a leaked key fails the build. Review auth and payment code on every change, not just before launch. A short checklist you run every time beats a thorough audit you do once.
Top comments (0)