Straight answers before you launch
The questions people ask an AI about an app an AI built, each answered in the first sixty words and then in detail, with the checks that settle it and the primary source for every claim. Dated, by Kenny Hyder. The incidents behind them are in the ledger.
- Lovable · Supabase
Is my Lovable app secure?
Not by default. A Lovable app is secure when every Supabase table has row level security on with a policy you can read, no secret key is in the bundle, and the routes behind the page refuse anonymous requests. The built-in scan checks the first from inside. The rest you check from outside, with the URL.
- Supabase · Row level security
Supabase RLS disabled: what does it expose?
Every row of the table, to anyone. The publishable key in your page reaches the database API directly, and a table without row level security answers it with all its rows, for reading and for writing. No login, no API of yours in the path. This one setting is behind most reported data exposures in AI-built apps.
- Launch · Cross-vendor seams
What do I need before launching an app built with AI?
Seven things between vendors that no builder checks: a domain that resolves and will not expire, DNS that points the apex and www at the host, SPF, DKIM and DMARC on the domain your emails send from, live payment keys and a webhook on the live domain, analytics that fires, a real 404, and privacy and terms pages.
- Email · Authentication
Why do my magic-link emails land in spam?
Because the domain the email sends from is not authenticated, or is not yours. Receivers check SPF, DKIM and DMARC on the sending domain, and a sign-in email from a domain without them, or from your auth provider's shared default sender, is treated as suspect. Fix the sending domain, not the template.
- Secrets · Rotation
My API key leaked from my app. What now?
Rotate it now, before any code change. Create the new credential at the provider, set it everywhere the old one lived, deploy, then revoke the old one and prove it is dead with one request. Then find every copy, including git history and build output, and block the next one with a scanner.
- Payments · Stripe
Is my app running Stripe in test mode in production?
Look at the publishable key in your page source. pk_test_ means every checkout the live domain opens runs in sandbox mode: test cards succeed, real cards are refused, no money moves, and nothing in your logs says so. pk_live_ means production. The server key and the webhook must match the same mode.
- Launch · Preview URLs
Can I check my app before I attach the domain?
Yes. Paste the preview or platform URL, such as my-app.vercel.app or my-app.lovable.app, and most of the grade runs: headers, TLS, secrets in the bundle, the database key and tables, the 404 status, legal pages, analytics, SEO. Mail, DNS and registration checks wait for the real domain and skip until then.
- Builders · Bolt, v0, Replit
Is my Bolt, v0 or Replit app production-ready?
Not on the builder's word alone. Each scans what it can see inside the project and says in its own documentation that this is not a complete review. None sees the live domain: the sending domain of your emails, the Stripe key mode, the 404 status, the headers, the registration, or a request to your API with no credential.
Every answer above is a check in the grade
Paste a URL, preview or live. Sixty-five checks, the evidence for each, the fix for each failure. Two free grades a day.