Guide · 2026-10-16

The launch checklist for AI-built apps

AI tools get an app from idea to deployed in an afternoon. They're also very good at skipping the boring parts that make a launch go well. Run through this list before you post your link anywhere.

Security: the things that cost money

1. No secret keys in the browser. Open your live site, open DevTools → Sources, and search for sk-, sk_live, service_role and your provider's key prefix. Anything you find there is public. How to check.
2. Your .env isn't downloadable. Visit yoursite.com/.env. It should be a 404.
3. Your .git folder isn't public. Visit yoursite.com/.git/config. Also a 404.
4. Database rules are on. If you use Supabase or Firebase, the browser key is public by design, so your row-level security or security rules are the only lock.
5. Spending limits are set on every paid API you call, so a leak or a bot can't run up an unlimited bill.

Sharing and search

6. A real page title, not "Vite + React" or "Create Next App".
7. A meta description of 120–160 characters.
8. Link preview tags (og:title, og:description, og:image) so your link looks good on X, Discord and iMessage.
9. A favicon, so browser tabs don't show a blank page icon.
10. robots.txt and a sitemap, and no leftover noindex from staging.

Polish

11. Basic security headers: HSTS, X-Content-Type-Options and frame protection.
12. No broken internal links, especially in your footer and nav.

Every item on this list is something Prelaunch Check tests automatically.