Before you tweet your launch, run these 69 checks. They map to the exact patterns behind the Lovable RLS CVE (CVE-2025-48757, 170+ apps, 2025), the Moltbook leak (1.5M API tokens, Feb 2026), and the April 2026 Lovable platform breach (source code + service keys of other users' projects, exposed ~2.5 months).
Want the full kit? 50 audit skills, 15 .cursorrules, 1 MCP config + 4 CLI recipes, 30 adversarial review prompts, 10 case studies. 5-minute install. $10 flat.
In an audit published October 2025, Escape.tech scanned 5,600 real AI-generated apps across 14,600 assets (methodology). They reported 2,038 critical vulnerabilities, 400+ leaked secrets and 175 instances of exposed PII across 1,400 of those applications (findings). The secrets came straight out of frontend bundles: Stripe, OpenAI and Supabase keys sitting in client-side JavaScript. It hasn't improved since: GitGuardian's 2026 report counted 28.6M new secrets on public GitHub in 2025 (+34% YoY), AI-service secrets up 81%, and commits co-authored by coding agents leaking secrets at roughly 2x the human baseline. This is a checklist of 69 specific, testable items. Each one maps to a real incident pattern. If you can tick all 69, ship. If you can't, fix what's blocking you.
Not a SaaS. Not a scanner. A flat list you run through before you push to prod.
The 69-Point Pre-Launch Security Checklist
You're 30 minutes from shipping. Stop. Run this first.
The Lovable RLS vulnerability alone (CVE-2025-48757, 2025, CVSS 9.3) exposed 170+ production apps. Moltbook exposed 1.5M API tokens in February 2026 — queryable with a single curl. These weren't edge cases. They were mainstream launches.
This checklist groups 69 specific, testable items across auth, secrets, APIs, databases, frontend, AI/LLM, agent tooling, and deployment. If you cannot tick all 69, do not ship.
Auth (8 items)
1. Database Row-Level Security (RLS) is enabled on every table in your database.
2. RLS policies exist for every table and every role (anon, authenticated, service_role).
3. JWT tokens are validated server-side on every protected API route (never trust the frontend to validate auth).
4. Sessions rotate or invalidate after login (CSRF + session fixation protection).
5. Magic links (passwordless auth) are single-use, expire in <15 minutes, and are tied to user IP or device fingerprint.
6. You cannot update or delete users, orders, or sensitive records based on user-supplied IDs alone. Test: try updating another user's record by changing the ID in the request.
7. CSRF tokens are validated on state-changing requests (POST, PUT, DELETE) via double-submit cookie or SameSite=Strict.
8. Session cookies have HttpOnly, Secure, and SameSite=Strict flags set.
Secrets & Environment (7 items)
9. No secrets in NEXT_PUBLIC_* vars, Vue/React .env files, or hardcoded strings. Grep NEXT_PUBLIC_ and audit all vars.
10. .env, .env.local, .env.*.local are in .gitignore and never committed. Check git history: git log --all -p | grep -i "api_key\|secret".
11. Supabase service_role key is ONLY in server-side .env (Node, Python, Go, etc.), never in frontend bundles or .env.local. The service_role key bypasses RLS entirely — one leak is full read/write to every table.
12. Stripe keys: public key in NEXT_PUBLIC_*, secret key server-only, webhook signing verified.
13. OpenAI, Anthropic, xAI API keys are never in frontend code; always proxied via your API.
14. No hardcoded API keys, database URLs, or credentials anywhere in source (including comments and unused code).
15. Secrets are rotated post-launch or if ever exposed in source history.
API Hardening (10 items)
16. Rate limiting is active on /api/auth/*, /api/login, /api/register. Test: 100 requests/minute should return 429.
17. All user inputs to /api/* are validated with Zod, Yup, or similar before touching the database. No raw req.body passed to queries.
18. No mass assignment: user cannot set admin=true, role=admin, or other sensitive fields by POSTing them.
19. Webhook signatures are verified (compare HMAC-SHA256 signature header to expected value using a constant-time comparison).
20. CORS is not set to *. Allowed origins are hardcoded and don't include localhost in production.
21. SQL queries use parameterized statements only. No string concatenation of user input into SQL.
22. NoSQL queries (MongoDB, Firebase, etc.) do not concatenate user input into filters or selectors.
23. File uploads are validated (mime type + file size), stored outside web root, and renamed to prevent path traversal.
24. Redirects after login are whitelisted. Cannot redirect to an external domain via open redirect.
25. API does not make unvalidated external requests. Ensure URLs used in server-side requests come from your allowlist, not user input (SSRF prevention).
Database (6 items)
26. RLS is ENFORCED on all tables. The anon role cannot SELECT/INSERT/UPDATE/DELETE on any table without an explicit policy granting it.
27. Public anon role has zero default permissions. Policies grant only what's needed. Read-only on public lists, never write.
28. Service-role key is used ONLY in server-side code. Verify: grep -r "service_role" src/. Should return zero results in frontend files.
29. User data isolation: queries always filter by auth.uid() or team_id. No query returns all records across all users.
30. Soft deletes (is_deleted flag) or archive tables prevent accidental data loss. Hard deletes are logged with actor + timestamp.
31. Database backups exist and are tested. You have verified you can restore from backup before this launch.
Frontend (8 items)
32. No dangerouslySetInnerHTML or innerHTML without DOMPurify sanitization. Audit every instance in the codebase.
33. All npm/pip/gem dependencies are scanned for known CVEs. Run npm audit, pnpm audit, or npx osv-scanner --lockfile=package-lock.json before launch — and check the specific versions in KNOWN-VULNERABLE-VERSIONS.md, because npm audit catches published CVEs but not malicious packages.
34. Content Security Policy (CSP) is enabled in production (strict-dynamic, no unsafe-inline). Test in staging first.
35. No /api/debug, /admin/backdoor, or internal test endpoints are accessible in production. Grep for "debug", "mock", "test-only" routes.
36. X-Frame-Options: DENY is set. Verify the header is sent on every response (prevents clickjacking).
37. Error messages do not leak internal paths, stack traces, or database schema in production. Test 404, 500, and permission errors.
38. No prototype pollution: user-supplied objects are not merged into application objects without sanitization.
39. React: no inline event handlers with unsanitized user data. Use react-dompurify or equivalent for any user content rendered as HTML.
AI & LLM (10 items)
These are the checks the old web-app playbooks never had. They map to the OWASP Top 10 for LLM Applications — and the 2026 edition (released Aug 3, 2026, the first weighted by real incident data from 6,639 cases) moved Excessive Agency from #6 to #3 and added Agent Hijacking, Multi-Modal Injection, and Memory Persistence. The agent items below are no longer theoretical.
boxed-dev/vibe-coding-security
