A pre-launch security checklist for apps built with Lovable, Bolt and Cursor

Hayden — Sun, 25 Oct 2026 12:26:39 +0000

You built an app over a weekend with Lovable, Bolt, Replit or Cursor. It works, the demo looks great, and you are about to share the link. Before you do, spend an hour on the boring stuff. AI tools are good at making things work. They are much less good at making things safe, because "safe" never shows up in a demo.

This is the checklist I run before any AI-built app gets real users. It is ordered by how often the problem bites, and none of it needs a security background.

1. Look for secrets in your front end

Anything your browser downloads is public. In Vite projects, every variable starting with VITE_ ends up in the JavaScript bundle. In Next.js it is NEXT_PUBLIC_. If a Stripe secret key, an OpenAI key or a Supabase service_role key sits behind one of those prefixes, anyone can copy it.

Open your deployed site, view the source, and search the JavaScript files for sk_, service_role and api_key. If you find a real secret, rotate it first and then move the call to a server function.

2. Check your database from the outside

If you use Supabase, the anon key is meant to be public. That is fine only when Row Level Security (RLS) is switched on for every table in the public schema and the policies are strict. Run this in the SQL editor:

select tablename from pg_tables
where schemaname = 'public' and not rowsecurity;

Every table it returns can be read by anyone holding your public key. Turn RLS on, then write policies such as using (auth.uid() = user_id). Policies that say using (true) are RLS in name only.

3. Test as a second user

Create two accounts. Log in as user A, copy the id of one of A's rows, then log in as user B and try to fetch it. If B can read it, your policies only check "is logged in" and not "is the owner". This is the single most common leak in AI-generated apps, and the anon test above will not catch it.

4. Don't leave files lying around

Visit /.env, /.git/config, and any backup file names your project might have produced. Each should return 404 or be blocked. Also check that the build output does not ship source maps you did not intend to publish.

5. Payments: trust the webhook, not the redirect

If you take payments, do not mark an order as paid because the user landed on a "thank you" page. Anyone can type that URL. Confirm payment from the provider's webhook, verify the signature on every event, and make the handler idempotent so a retry does not grant access twice.

6. Auth settings

Set the Site URL and allowed redirect URLs in your auth provider to your real domain, not a wildcard. Make sure password reset and email confirmation actually work in production, with a real inbox.

7. Add limits

Signup, login, password reset and any endpoint that sends email or calls a paid API need rate limits. Without them, one script can burn your monthly API budget in an afternoon. Set a spending cap or alert on every paid service.

8. Headers and HTTPS

Force HTTPS and add the basic security headers: Strict-Transport-Security, Content-Security-Policy (even a loose one), X-Content-Type-Options and a frame policy. Hosts like Vercel and Netlify let you set these in a config file.

9. Click through your own app

Sign up, log in, reset a password, pay, delete your account, and open every page. Broken links and 500 errors are not security holes, but they are the first thing a stranger sees.

10. Have a way back

Turn on backups for your database and test one restore. Keep your code in Git and commit before each big AI change, so a bad edit is a one-command undo.

What a checklist cannot do

None of this is a penetration test, and I would not call any automated check one. A checker looking at your site from the outside cannot see behind your login, and it cannot judge your business logic. Steps 3, 5 and 6 above need you to try things by hand.

Full disclosure: I built DeployVet, a free check that does steps 1, 2, 4, 8 and 9 for you from the outside, because those steps are easy to skip. Use it, use another tool, or just use this list. The point is to look before your users do.

What self-hosting n8n actually costs in 2026: VPS vs n8n Cloud

Hayden — Fri, 23 Oct 2026 12:47:26 +0000

Self-hosting n8n looks cheap until you read the fine print. A $5 VPS headline usually means a 24-month prepay, and the renewal price is what you actually pay long term. Here is what I found when I checked providers' public pricing pages on 2026-10-22.

What n8n needs

n8n plus Postgres in Docker idles at roughly 0.5-1 GB of RAM and spikes with large payloads or many concurrent runs. My rule of thumb: 2 GB for light use, 4 GB as a comfortable minimum, 8 GB for heavy workflows.

Cheapest workable VPS plans (USD/month)

Plan	Specs	Intro	Renewal
Contabo Cloud VPS 10	4 vCPU, 8 GB, 100 GB	$5.28	$6.60
Hostinger KVM 1	1 vCPU, 4 GB, 50 GB	$6.49	$11.99
OVHcloud VPS-1	2 vCPU, 4 GB, 40 GB	$4.54	not verified
DigitalOcean Basic 4 GB	2 vCPU, 4 GB, 80 GB	$24	$24
Vultr 4 GB	2 vCPU, 4 GB, 80 GB	$20	$20

Contabo and Hostinger need a 24-month term for the intro price. DigitalOcean and Vultr bill hourly with no lock-in, which is worth something if you are not sure yet.

n8n Cloud vs self-hosting

n8n Cloud Starter is $24/mo ($20 billed annually) for 2,500 executions; Pro is $60/mo ($50 annually) for 10,000. If you run a few workflows and don't want to maintain a server, Cloud is reasonable. If you run many scheduled workflows, the execution cap is the thing to watch, and a VPS has no cap beyond its hardware. Details: n8n Cloud vs self-hosted.

Costs people forget

Backups: snapshots usually add 10-20%, or run a nightly pg_dump to object storage. Back up your N8N_ENCRYPTION_KEY too, without it your credentials are gone.
Domain: about $10-15/year. TLS via Let's Encrypt is free.
Your time: a couple of hours to set up, then about an hour a month for updates and checks.

The tools

I built StackCost to put these numbers side by side, with renewal prices shown first and unverified numbers left blank:

selfhostcalc.com - price tracker
Calculator - estimate your monthly cost
Cheapest VPS for n8n
Raw data

Disclosure: I run the site. Some "View deal" links may become affiliate links in the future; see the affiliate disclosure.

DEV Community: Hayden