AI coding tools like Lovable, Bolt, Cursor, Replit and Claude Code have made it possible to go from an idea to a working app in a weekend. That’s genuinely exciting. But “working” in a demo and “safe to launch” with real customers and real data are two very different things.
Vibe-coded apps tend to look finished long before they are. The AI writes code that does what you asked, not necessarily what you’d have asked if you knew where the risks were. This checklist covers the issues we see most often when we review AI-built apps, with an Australian lens on privacy and personal data.
You don’t need to be a developer to use it. If you can’t confidently tick an item off, that’s a sign to get a second pair of eyes on it before you launch.
1. Is your database locked down?
Many AI-built apps use Supabase or a similar backend-as-a-service. These platforms are excellent, but they rely on you configuring access rules correctly.
- Row Level Security (RLS) is switched on for every table your app exposes. Without it, anyone with your app’s public key can read or change data they shouldn’t.
- Your RLS policies actually match your rules. A policy that says “logged-in users can read this table” may still let one customer read another customer’s records.
- Storage buckets aren’t public by accident. Uploaded files such as invoices, ID documents and photos should only be visible to the people who own them.
A quick test: log in as one user, then try to load another user’s records by changing an ID in the URL or the request. If it works, so will an attacker.
2. Are any secret keys in the browser?
Anything that ships to the browser or the app bundle can be read by anyone. AI tools sometimes put keys in the wrong place to “make it work”.
- No secret or admin keys in front-end code. Supabase’s anon key is designed to be public; the service role key is not. The same applies to Stripe secret keys, OpenAI or Anthropic API keys, and email provider keys.
- No secrets committed to your Git repository, even in an old commit. If one ever was, rotate it.
- Paid API calls go through your server, not straight from the browser, so nobody can lift your key and run up your bill.
3. Does your app trust the client?
A common pattern in AI-generated code is checking permissions in the user interface only: hiding the “Delete” button from non-admins, for example. That’s a convenience, not security.
- Every permission check happens on the server (or in database policies), not just in the screen the user sees.
- Prices, discounts and totals are calculated server-side. Never accept an amount from the browser at face value.
- Roles can’t be changed by the user. Check that a user can’t promote themselves to admin by editing their own profile record.
4. What happens when someone abuses it?
Real users make mistakes, and some people go looking for weaknesses.
- Rate limiting on logins, sign-ups, password resets and any endpoint that costs you money, such as AI calls or SMS.
- Input validation on the server for every form and API: lengths, types and formats, so unexpected input can’t break things or be injected into queries.
- File uploads are checked for type and size, and stored somewhere they can’t be executed.
5. Will you know when something breaks?
Demo apps rarely have any way to tell you something has gone wrong.
- Error logging and alerting are set up, so you hear about failures before your customers do.
- Errors shown to users are friendly and don’t leak stack traces, database details or keys.
- Basic uptime and performance monitoring is in place, particularly around payments and sign-up.
6. Can you recover from a bad day?
- Automated, tested backups of your database and uploaded files. A backup you’ve never restored is a hope, not a backup.
- Separate development and production environments, so testing a change can’t wipe live customer data.
- You own the accounts. Your domain, hosting, database, app-store listings and code repository should be in your business’s name, not a contractor’s.
7. Are you handling personal information properly?
If your app collects names, emails, phone numbers, health details or payment information, Australian privacy law applies to how you handle it.
- Know whether the Privacy Act applies to you. The Australian Privacy Principles generally apply to businesses with an annual turnover over $3 million, and to some smaller businesses regardless of turnover, such as health service providers.
- Collect only what you need, and tell users what you collect and why in a clear privacy policy.
- Know where your data is stored and processed. If personal information goes to overseas services, including AI providers, consider your obligations around cross-border disclosure.
- Have a plan for a data breach. Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify affected individuals and the OAIC about eligible data breaches likely to result in serious harm.
This isn’t legal advice, and every business is different. But privacy is far easier to design in before launch than to bolt on after a breach.
8. Will it cope with real users?
- Test with realistic data volumes, not the ten test records you created. Slow queries often only show up at scale.
- Walk every workflow end to end, including the unhappy paths: cancelled payments, expired sessions, duplicate submissions and third-party services that time out.
- Check it on real devices, including older phones and slower connections.
So, is your vibe-coded app safe to launch?
If you’ve worked through this list and ticked everything off with confidence, you’re in a much better position than most. If some items made you pause, that’s normal. AI tools are brilliant at getting you to a working prototype quickly; they’re less reliable at the unglamorous details that keep real customers and their data safe.
That’s where an experienced human review earns its keep. Our AI App Launch Audit puts your app through our 100+ point checklist, covering security and secure design, exposed keys, missing validation, auth that trusts the client, scalability, error handling and integrations. Then we help you fix what we find. Audits are fixed price and quoted up front.
Not sure whether you need one? Book a free 30-minute chat with an engineer. If your app is ready to launch, that’s the answer you’ll get.
