Is Your AI-Built App Production Ready? The 15-Point Checklist

You've built something with Cursor, Lovable, Bolt, or Replit. It works. You're excited. But is it actually ready for real users?

Here's the checklist our developers run through on every audit. Score yourself honestly — each item is a yes or no.

Security (5 points)

1. Are all API keys server-side only? No secrets in client-side code, no sensitive keys in NEXT_PUBLIC_ or VITE_ environment variables. Only public keys (like Supabase anon key) should be browser-accessible.

2. Is every API endpoint authenticated? Every endpoint that reads or writes user data checks for a valid session. No endpoints are accessible without authentication unless they're explicitly public.

3. Is user input validated on the server? Client-side validation is for UX. Server-side validation is for security. Every form submission, API request, and URL parameter must be validated server-side before touching your database.

4. Is there rate limiting on public endpoints? Contact forms, login attempts, API routes — all need rate limits. Without them, bots and attackers can abuse your endpoints at scale.

5. Is sensitive data encrypted and access-controlled? Database rows are protected by row-level security or equivalent. Passwords are hashed. Sessions use httpOnly cookies, not localStorage. (For a deeper dive on each of these items, see our vibe coding security checklist.)

Reliability (5 points)

6. Does the app handle errors gracefully? When an API call fails, does the user see a helpful message or a blank screen? Are there error boundaries catching React crashes? Does the app recover without a full page reload? If your app is already crashing, read why AI-generated apps keep crashing for the most common causes and fixes.

7. Is there logging and error monitoring? Can you see when something breaks in production? Tools like Sentry, LogRocket, or even basic server-side logging mean you find bugs before users report them.

8. Does it work on mobile? Not "it kind of works" — actually test every flow on a real phone. Forms, navigation, modals, authentication. Mobile users are less forgiving.

9. Are database queries optimised? Are you fetching only the data you need? Are frequently-queried columns indexed? Does the app slow down noticeably when there's more than a handful of records?

10. Can it handle concurrent users? What happens when 50 people use your app at the same time? Race conditions, duplicate submissions, and connection pool exhaustion are common issues in vibe-coded apps.

Launch Readiness (5 points)

11. Is analytics tracking installed? You need to know what users do. Page views, button clicks, conversion events, drop-off points. Without analytics, you're flying blind.

12. Is there a proper landing page? Not your app's login screen — a dedicated page that explains what your app does, who it's for, and why they should care. With a clear call to action.

13. Is SEO configured? Page titles, meta descriptions, Open Graph images, sitemap, robots.txt. These are table stakes for discoverability.

14. Is there a deployment pipeline? Can you ship changes confidently? Even a basic setup — push to main, auto-deploy to production — is better than manual deployments.

15. Do you have a launch plan? Where will your first 100 users come from? Which communities, channels, or platforms will you target? "Post on Twitter" is not a launch plan. If Product Hunt is part of your strategy, our Product Hunt launch guide covers everything from technical prep to launch day execution.

Score yourself

• 12-15: You're close. A focused review pass could get you to launch.
• 8-11: There's meaningful work to do. Prioritise security and reliability.
• 4-7: You need a proper audit before putting this in front of users.
• 0-3: The app isn't ready. But that's OK — that's exactly what we help with.

What's next

If you scored lower than you'd like, that's normal. Most vibe-coded apps land somewhere in the 5-10 range. The gap between "it works" and "it's production-ready" is exactly what our team closes.

Request a free audit and we'll send you a detailed security snapshot within 48 hours. Or book a discovery call and we'll walk through your app together.