← LaunchLatch home

Cursor / Bolt app security checklist: 10 things to check before you launch

Cursor and Bolt write working code fast, but "it works" and "it's safe" aren't the same thing. Go through these 10 checks before you share your link. Most take a few minutes each.

1. Secrets live in environment variables, server-side only

API keys for OpenAI, Stripe (secret key), Supabase service_role, Resend and similar services must never ship to the browser. Anything prefixed VITE_, NEXT_PUBLIC_ or EXPO_PUBLIC_ is bundled into frontend code and is public.

• Search your built site: View Source and DevTools → Sources for sk-, sk_live_, service_role.
• Make sure .env is in .gitignore and scan git history with gitleaks.
• Rotate any key that was ever exposed; deleting it from code isn't enough (step-by-step fix).

2. Auth checks happen on the server

Hiding a button or redirecting in React doesn't protect anything. Every API route, server action or edge function that reads or changes data must verify the user's session itself and check that the user owns the record. Don't trust a userId sent from the client; read it from the verified session or JWT.

3. Row Level Security is on (if you use Supabase)

The Supabase anon key is public by design, so RLS is what stands between it and your data. Turn RLS on for every table and add owner-only policies such as auth.uid() = user_id. Check storage buckets too. Full walkthrough: Supabase RLS checklist.

4. Rate limiting on expensive and sensitive endpoints

Login, sign-up, password reset, contact forms and anything that calls a paid AI API need limits per IP and per user. Without them, one script can run up your OpenAI bill or brute-force passwords. Use your host's or provider's built-in limits, or a store like Upstash Redis, and set hard spending caps on paid APIs.

5. CORS is locked to your own domains

AI-generated backends often ship with Access-Control-Allow-Origin: *. List your production domain (and preview domain if needed) instead. Never combine a wildcard origin with credentials. Remember CORS only limits browsers; it's not a substitute for auth checks (item 2).

6. Input is validated on the server

Validate every request body, query param and upload on the server with a schema (Zod, Valibot or similar): types, lengths, allowed values, file type and size. Use parameterized queries or your ORM instead of string-built SQL, and don't render user content as raw HTML (watch for dangerouslySetInnerHTML).

7. Dependencies are audited

Run npm audit (or pnpm audit) and fix high and critical issues. Check that every package the AI added actually exists and is the one you meant; AI tools sometimes invent package names that attackers then register. Remove packages you don't use and commit your lockfile.

8. Errors don't leak internals

Users should see a friendly message, not stack traces, SQL errors, file paths or environment values. Log the details server-side (Sentry or your host's logs) and return generic errors. Make sure production builds have debug mode off and source maps aren't publicly exposing server code.

9. Admin routes are protected and hard to abuse

Pages like /admin or /dashboard/users must check an admin role on the server for every request and every action, not just on page load. Store roles somewhere users can't edit (not a column they can update through the API, and not user_metadata in Supabase). Remove test accounts, seed users and debug endpoints before launch.

10. Backups exist and you've tested a restore

Turn on automated database backups (Supabase Pro includes daily backups; on the free plan, schedule your own pg_dump). Keep your code on GitHub, export anything stored only in a third-party tool, and do one practice restore so you know it works before you need it.

Before you hit deploy

Run through the broader vibe-coded app launch checklist for payments, deploys and monitoring, and see the tools we recommend for secret scanning, auth and hosting.

Last updated October 16, 2026.