Before widening access to an AI-built app, ten points need to be checked: API keys server-side, access rules on the database, complete authentication, tested backups, a domain in your name, updated dependencies, monitoring, GDPR compliance, an end-to-end test of the critical path and a written recovery plan. Here they are in the order we check them, with, for each one, who can take care of it.
This list extends the basics checklist: the basics keep you in control while you build, this one opens the doors without bad surprises.
The 10 points, in order
1. API keys server-side
Open your app in the browser, view the source code, search for "key", "secret", "sk_". If a secret key shows up, it's public: anyone can consume your services (and your budget) in your place. Keys move server-side. Difficulty: needs a developer.
2. Access rules on the database
Does the database only answer legitimate queries? On Supabase, that's the RLS rules (full explanation here). The five-minute test exists, the fix requires understanding your data model. Difficulty: the test is within your reach, the fix needs a developer.
3. Complete authentication and authorisation
Forgotten password, session expiry, server-side route protection, account deletion and role separation. Test each case with several user profiles. Difficulty: the test is within your reach.
4. Tested backups
A daily automatic backup, and above all: a restore tried at least once. A backup never restored is a hypothesis, not a protection. Difficulty: within your reach, via your database's dashboard.
5. Domain and accounts in your name
Domain, database, keys, hosting: every critical account on your email, with a strong password and two-factor authentication. It's the heart of the basics checklist. Difficulty: within your reach, today.
6. Updated dependencies
Generated code ships with dozens of software building blocks, and some have pending security updates. A dependency audit lists them in one command. Difficulty: needs a developer.
7. Monitoring that warns you
When your app breaks on a Saturday night, who knows first: you, or your best customer? A free monitoring tool that emails you at the first crash changes the answer. Difficulty: within your reach with a tutorial.
8. GDPR compliance
Legal pages and a privacy policy that tell the truth, data located in Europe, account deletion possible. For a reasonable app, it's a well-framed afternoon. Difficulty: within your reach with a serious template.
9. The critical path tested end to end
The flow that keeps your app alive (sign up, pay, get the service) must be tested from start to finish, on mobile, with a fresh account. Not "it should work": tested. Difficulty: within your reach, and nobody will do it better than you.
10. A written recovery plan
If the app goes down: who does what, in what order, with which access? One page is enough. Writing it before the incident takes twenty minutes; during the incident, everything costs ten times more. Difficulty: within your reach, tonight.
The tally
Six points out of ten are within your reach without writing a line of code: that's the "hygiene" part, and it can't be bought, it gets done. The other four (keys, access rules, authentication, dependencies) require reading code: that's exactly the Scan's scope, which checks them all, prices what's stuck, and lets you decide what's next. Your app comes from Lovable, Bolt or v0? Each platform also has its specific checks, detailed on its page.