Free · Print it, share it, use it
The launch checklist
for AI-built apps.
The front end is the UI. The back end is everything that makes it work. Before real people use something AI built, walk through these ten and paste each prompt into your AI.
- 01
Your data · What things are and how they connect
This is the shape of your database. If you don't define it, AI guesses, and the guess gets built into everything. One of my builds treated a small group as if it were a whole division of the organization: right code, wrong idea.
“Describe the data model you built: every table, what it stores, and how the tables connect. Flag anything you assumed instead of being told.”
- 02
Accounts · Getting in, back in, and out
Accounts are a lifecycle, not a sign-up screen. The App Store rejected my walking game partly because there was no way to delete an account.
“Walk me through every account flow in this app: sign up, sign in, forgot password, sign out, delete account. Which ones are missing or only half built?”
- 03
Permissions · Who can see and change what
A hidden button isn't a lock. Anyone who knows how apps talk to servers can skip the screen. My app once kept people out of private groups only by hiding the button.
“For every piece of private data, show me where the server checks who is allowed to read or change it. List anything that is only protected by hiding it in the UI.”
- 04
Database rules · The lock on every table
Many AI app builders put your data in a database that anyone with your app's public key can query. The rules are the only thing standing between strangers and your users' data. Apps have leaked thousands of records because one setting was off.
“List every table in my database and whether access rules (row-level security or security rules) are enabled on it. For each one, explain in plain English who can read and write it.”
- 05
Secret keys · Passwords your app uses
Anything in the front end can be read by anyone who opens your app. Secret keys belong on the server, stored as environment variables, never in code people can see.
“Search this project for API keys, secret keys, tokens and passwords. Tell me which ones are exposed in front-end code or committed to the repo, and how to move them to environment variables on the server.”
- 06
When things break · Half-finished actions
AI builds the happy path by default. The half-finished cases only get handled if someone asks, and they're the ones that cost money and trust.
“For each important action in this app (sign up, save, pay, upload), what happens if it fails halfway through? Show me where each failure is handled and what the person sees.”
- 07
What leaves your app · Emails, notifications, payments
These leave your system the instant they fire, and deleting data afterward doesn't take them back. My app's automated tests cleaned up the database perfectly, and had already sent notifications to real people's phones.
“List everything this app sends outside itself: emails, push notifications, texts, payments, webhooks. For each one, how do I test it without reaching a real person or charging a real card?”
- 08
Uploads · Photos, files and video
Uploads usually live separately from the rest of your data, with their own limits, costs and privacy rules. A private group's photos need to be as private as its messages.
“Where are uploaded files stored? What are the size and type limits? Who can open a file if they have its link, and is that checked on the server?”
- 09
Hosting and cost · The machine and the bill
Speed lives on a real machine. My app once took 15 to 30 seconds to load messages while the database query took 79 milliseconds: the server had run out of borrowed processing power. Upgrading my plan didn't upgrade the machine.
“What services does this app run on, what does each cost per month at my current usage, and what are the limits? What breaks first if usage goes up ten times?”
- 10
Knowing when it breaks · Alerts and logs
Check the thing that matters. On one side project my alert only checked that the server was on, and the product was dead for three weeks before anyone noticed. Keys expire too, and when one does, everything stops at once.
“How would I find out if this app stopped working right now? Set up error alerts that check what users actually experience, and list any keys or certificates that will expire.”
Using a specific tool? The Lovable, Bolt, Cursor and Claude Code, Supabase and Firebase launch checklists show where each of these lives in that tool, plus what to check before you go live.
The stories behind each one are in the essay: Vibe coding gets you a demo. Here's what it takes to ship a product.
Newsletter · Free
Get the free Fix Kit, then one prompt a week.
The check, fix and confirm prompts for all ten items, then one system, one real story and one prompt every week. No spam.
Common questions
What is a vibe coding checklist?
A short list of the back-end systems an app built with AI needs before real people use it: data, accounts, permissions, database rules, secret keys, failure handling, outbound messages, uploads, hosting and cost, and monitoring. AI builds what you ask for, so the checklist tells you what to ask for.
Is my vibe-coded app safe to launch?
It depends on what is underneath the screens. The most common gaps are database access rules that are turned off (such as row-level security in Supabase or open rules in Firebase), secret keys exposed in front-end code, and private data that is only hidden in the interface instead of checked on the server. Check those three first.
What should I check before launching an app built with Lovable, Bolt or Cursor?
Turn on and test database access rules for every table, move secret keys to server-side environment variables, make sure private data is checked on the server, test sign-up, password reset and account deletion, and set up an alert that tells you when the app breaks. Lovable and Supabase also include built-in security checks: read every warning before you publish.
Do I need to be a developer to use this checklist?
No. Each item comes with a plain-English explanation and a prompt you can paste into the AI tool you build with, so the AI checks its own work against your app. It is a guide, not a professional security audit.