The Vibe-Coded App Launch Checklist (2026)

You prompted, you iterated, it works. Before you drop the link anywhere, spend 15 minutes on this list. It covers the boring stuff that bites vibe-coded apps after launch.

Each item has why it matters and how to check it yourself. If you'd rather skip the DevTools spelunking, ChillScan checks most of these in ~30 seconds for free.

Quick version
No secret keys in the frontend · HTTPS everywhere · 5 security headers set · title/description/OG on every page · sitemap + robots · real HTML for Google · page loads fast · DB rules locked down · rate limits on anything that costs money.

🔑 Part 1: Secrets

1. No secret API keys in your JavaScript
Why: Anything in your frontend bundle is public. An OpenAI or Anthropic key in there means anyone can run up your bill. A Stripe secret key or Supabase service_role key is worse.
How to check: Open your live site → DevTools → Sources (or Network → JS files) → search for sk-, sk_live_, sk-ant-, service_role, AKIA.
Fix: Rotate the key immediately, then move that call to a server route or edge function.
2. Know which keys are meant to be public
Why: Not every key is a problem. Supabase anon keys, Stripe publishable keys (pk_) and Firebase web config are designed to live in the browser. They're safe only if your database rules / Row Level Security are set up properly (see item 12).
How to check: For each key you find, look up its type. "Publishable", "anon" and "public" are usually fine; "secret", "service" and "admin" never are.
3. Secrets live in env vars, not in code
Why: Hard-coded keys end up in git history, screenshots and AI chat logs.
How to check: Search your project for the key value. Also watch for prefixes like VITE_, NEXT_PUBLIC_ and REACT_APP_: those get bundled into the frontend on purpose. Never put a secret behind one of them.

🛡️ Part 2: Security headers

4. Set the core five
Why: These stop clickjacking, MIME sniffing and leaky referrers, and enforce HTTPS. Many AI-generated apps ship without most of them.
How to check: DevTools → Network → click your page → Response Headers.
- Strict-Transport-Security (HSTS)
- Content-Security-Policy (start in report-only if you're nervous)
- X-Frame-Options: DENY (or CSP frame-ancestors 'none')
- X-Content-Type-Options: nosniff
- Referrer-Policy: strict-origin-when-cross-origin

🔒 Part 3: HTTPS & redirects

5. HTTP always redirects to HTTPS
How to check: Visit http://yourdomain.com. You should land on https:// in one hop.
6. No redirect chains or mixed content
Why: http → www → https → /home is slow and messy. Mixed content (HTTP images or scripts on an HTTPS page) triggers browser warnings.
How to check: DevTools Console shows mixed-content warnings. Network tab shows redirect hops.
7. Cookies are Secure (and HttpOnly for sessions)
How to check: DevTools → Application → Cookies. Session cookies should have both flags.

🔎 Part 4: SEO basics

8. Every page has a real title, description and Open Graph tags
Why: It decides what people see when your link shows up on Google, X, Slack and iMessage. Lots of vibe-coded apps ship with "Vite + React" as the title.
How to check: View source and look for <title>, <meta name="description">, og:title, og:image.
9. robots.txt + sitemap.xml exist and list your real pages
How to check: Visit /robots.txt and /sitemap.xml. The sitemap should include every page you want found, not just the homepage.
10. Google sees content, not a blank page
Why: Pure client-side apps can look empty to crawlers and link previews.
How to check: Right-click → View Page Source (not Inspect). If your main text isn't there, consider pre-rendering or SSR for public pages.

⚡ Part 5: Performance

Bonus check — worth doing before you share the link widely.

11. Fast enough on a phone
Why: Slow first loads kill signups. Watch server response time, total page weight and JS bundle size.
How to check: Run PageSpeed Insights on mobile. Big JS bundles are the usual culprit.

🧠 Part 6: The stuff no external scanner can see

Be honest with yourself here. ChillScan (and any URL-based scanner) can't see these:

12. Database rules and auth logic

Supabase: Row Level Security enabled on every table, with policies that match who should read/write what.
Firebase: Firestore/Storage rules aren't left in test mode.
Can user A load user B's data by changing an ID in the URL? Try it.
Anything that costs you money (AI calls, emails, SMS) has rate limits.
Backups are on.

Platform-specific versions: Lovable security checklist, Bolt.new launch checklist, v0 + Vercel SEO checklist and Replit launch checklist. See also the Bolt, Replit and v0 scan pages.

Copy this checklist

Markdown you can paste into a note or PR description.

[ ] No secret keys in frontend JS (rotate if found)
[ ] Only public-by-design keys in the browser
[ ] Secrets in env vars, none behind VITE_/NEXT_PUBLIC_
[ ] HSTS, CSP, X-Frame-Options, nosniff, Referrer-Policy set
[ ] HTTP → HTTPS in one hop
[ ] No redirect chains / mixed content
[ ] Secure + HttpOnly session cookies
[ ] Title, description, OG tags on every page
[ ] robots.txt + sitemap.xml with all pages
[ ] Content visible in View Source
[ ] Mobile load is fast, JS bundle reasonable
[ ] RLS / DB rules locked, rate limits on paid APIs, backups on

Want the 30-second version?

Paste your URL and ChillScan checks the publicly visible parts of items 1–11 for you — free, no signup. (It can't see your source code or env vars, so items 2 and 3 still need a look.) The $12 deep scan adds every finding with explanations, fix tips and evidence, plus one prompt to fix it all in Cursor, Claude, Lovable or Bolt.

Scan my app free See pricing

Building with Lovable? Start with the Lovable security checklist.