Free tool / 2 minutes

Is your AI-built app ready for real users?

Twelve questions about security, data, payments and running it. Answer yes, no or not sure, and you'll see what's covered and what to fix first. It's the checklist we use when we take over apps built with Lovable, Bolt, v0 and Cursor.

Security

1No secret keys in the browser

Search your live site's JavaScript (in the browser's developer tools) for words like key, secret or sk_. Only publishable keys belong there.

2Users can only see their own data

Log in as a second test user and open a link to the first user's record. You shouldn't be able to see it.

3Admin pages are protected on the server

Open the admin pages while logged in as a normal user, and while logged out. Both should be refused.

Data

4The server checks what it receives

Prices, quantities and roles are checked or worked out on the server, not only in the form.

5Backups exist, and you've restored one

You know where the database backups are and how often they run, and you've restored one into a test copy.

6Test and live are separate

There is a staging copy with its own database, its own keys and payments in test mode.

Money and messages

7Payments are confirmed by the payment provider

An order is only marked as paid when your server receives a verified webhook from Stripe (or your provider), never because the browser showed a "success" screen.

8Emails actually arrive

Sign-up and password emails come from your own domain, with SPF, DKIM and DMARC set up, and land in Gmail and Outlook inboxes, not spam.

Running it

9You own the accounts, and deploys are repeatable

Hosting, domain, database, email and payment accounts are in your company's name, and releasing a change is one repeatable step.

10You hear about errors before your users do

Error tracking (such as Sentry) and an uptime check alert you with enough detail to fix the problem.

11There are limits on abuse and AI spend

Sign-up, login and AI features have rate limits, and your AI provider account has a monthly spending cap.

12Someone else could change it safely

A new developer could get it running from the README, the settings are written down, and sign-up, payment and your core feature have tests.

What a demo never shows

A demo only has to work for you, on the happy path, with test data. A launched product has to work for strangers, with real data and real money. These twelve points are where AI-built apps most often fall short, and each one is explained, with how to check it, in our launch checklist article.

If three or more are open, that's normal, and it's usually fixable without starting over. See how prototype rescue works.

Want us to check it properly?

Our 48-hour health check goes through all twelve points on your code and gives you a written report in order of risk, with a fixed quote for getting it live.

Start a project Book a 15-minute call

Or email hello@cybersialabs.com