Is your AI-built app ready to launch?
These are the checks I run before any app built with Lovable, Bolt, Replit or Base44 goes live. Tick the ones you have done. It takes about ten minutes, and your answers stay in this browser.
Your data
0 of 4 doneThis is where most AI-built apps leak.
Sign-up and login
0 of 4 donePayments
0 of 4 doneApp Store and Google Play
0 of 4 doneOnly for phone apps.
Before you share the link
0 of 4 done0 of 20
checks done
Tick the checks you have done to see where you stand.
What's left
- 1. Every table has Row Level Security turned on.
Why it matters: Without it, anyone with your app's public key can read or change every row.
- 2. People can only see their own data.
Why it matters: Row Level Security can be on and still let everyone in if the rules are too loose.
- 3. No secret keys in the code that runs in the browser.
Why it matters: Anything sent to the browser can be read by anyone. A leaked secret key opens up your payments or your whole database.
- 4. Admin pages are locked on the server, not just hidden.
Why it matters: Hiding a menu link does not stop someone who types the address.
- 9. Paid access is unlocked by Stripe's webhook, not by the success page.
Why it matters: If the browser decides who has paid, anyone can get your product for free.
- 10. Your webhook checks Stripe's signature.
Why it matters: Without it, anyone can send your server a fake "payment succeeded" message.
- 5. Login emails arrive, and their links open your real domain.
Why it matters: Links that point to localhost or an old preview address leave people stuck.
- 6. Login emails are sent through your own email provider.
Why it matters: Supabase's built-in email only sends to your own team, about two emails an hour. Real users will not get theirs.
- 7. If you offer Google login on iPhone, you also offer Sign in with Apple.
Why it matters: Apple requires an equal privacy-friendly option (guideline 4.8).
- 8. People can delete their account.
Why it matters: Apple and Google Play require it for any app with sign-up, and privacy laws like GDPR expect it.
- 11. Cancelled and failed payments remove access.
Why it matters: Many AI-built apps keep access open forever after one payment.
- 12. Live keys and a live webhook are set up.
Why it matters: Test mode and live mode are separate. Without the live webhook, real payments unlock nothing.
- 13. Your app does more than show your website.
Why it matters: Apple rejects apps that feel like a repackaged website (guideline 4.2).
- 14. Apple's reviewers can log in.
Why it matters: Apple asks for a demo account for any app with a login (guideline 2.1). A missing one is a quick rejection.
- 15. You know how you will take payments inside the app.
Why it matters: Using Stripe for digital goods inside an iPhone app is one of the most common rejections.
- 16. Your Google Play closed test is planned.
Why it matters: Without it you cannot apply for production. Plan two weeks for it, or your launch date slips.
- 17. Your app has its own name, icon and link preview.
Why it matters: Default titles are the first sign that an app was rushed.
- 18. It runs on your own domain with HTTPS.
Why it matters: People trust a real domain, and app store listings and email both work better with one.
- 19. You have a privacy policy that matches what you collect.
Why it matters: Apple and Google need the link, and your store privacy answers must match it.
- 20. Your database will not pause or disappear.
Why it matters: A paused database means a dead app, and without backups one bad change can wipe real users' data.
Want help with what's left? I'm Paul, and I finish and launch AI-built apps for a living. I check your app against this list, send you written findings, and then quote a fixed price.