← LaunchLatch home

Vibe-coded app launch checklist

AI builders get you to a working demo fast. These are the checks that catch the problems that tend to show up after real users arrive.

Secrets and keys

• No secret keys in frontend code or in VITE_ / NEXT_PUBLIC_ variables (how to fix an exposed key).
• .env is in .gitignore, and git history has no committed secrets (run gitleaks).
• Any key that was ever exposed has been rotated.
• Spending limits are set on OpenAI and other paid APIs.

Database and data

• RLS is on for every Supabase table, with owner-only policies (RLS checklist).
• Storage buckets holding private files aren't public.
• Backups are enabled, and you know how to restore one.

Auth and permissions

• Admin pages and actions are checked on the server, not just hidden in the UI.
• Users can't edit their own role or plan.
• Auth redirect URLs list your production domain, not just localhost or the preview URL.
• Email confirmation and password reset work on the live domain.

Payments

• Stripe webhooks verify the signature with the webhook signing secret.
• Webhook handling is idempotent: the same event delivered twice doesn't double-credit.
• Access is granted from the webhook, not from the success page redirect.
• You've done one real purchase and one refund in live mode.

Deploy and operations

• Every environment variable from preview is set in production.
• The production build passes locally (npm run build) with no errors.
• Error pages and empty states work; there's no blank screen on a bad URL.
• Error monitoring and uptime alerts are set up.
• Basic rate limiting on sign-up, login and any endpoint that costs you money.
• A privacy policy and terms exist if you collect personal data or take payments.

Stop the fix-break loop

Before you ask the AI for more changes, commit a working version, keep a staging copy, and add a few tests for the flows that matter most: sign-up, login, payment and the core feature.

Last updated October 16, 2026.