Launch guides for vibe-coded apps

Concrete checklists and fix paths for the problems that show up right before you charge money. Pair any guide with the free URL check.

• Supabase RLS checklist before launch

  If your vibe-coded app talks to Supabase from the browser, Row Level Security is the difference between “users see their own data” and “anyone with the anon key reads the whole table.”

• How to ship a Cursor or Claude Code app safely

  AI coding agents are great at generating working apps and equally good at “fixing” twenty files you did not ask about. Shipping safely is less about never using agents and more about putting them on a leash.

• Stripe webhooks not working in production

  Most “Stripe works in test, breaks in prod” reports are the same few mistakes. Fulfillment on the success page, the wrong webhook secret, or a body parser that breaks signature verification.

• Leaked API keys in your frontend bundle: how to check

  If a secret can call a paid API or bypass your database rules, it does not belong in JavaScript the browser downloads. Here is how to find leaks fast and what to do when you find one.

• A vibe-coded app launch checklist

  Your app runs on a preview URL. Friends can click around. Launch is the moment real users and real money show up. This checklist is the short version of what usually breaks first.

• Lovable and Bolt app security before launch

  AI app builders get you from idea to working app in an afternoon. They don't decide who should be allowed to read which rows. That part is still yours, and it's checkable without writing code.

• Supabase anon key exposed: is it a problem?

  Short answer: the anon key being visible is normal. Whether that's a problem depends entirely on your Row Level Security. The service_role key is a different story.

• Payment success-page bypass: verify payments server-side

  One of the most common bugs in AI-built paid apps: the success page grants access. Anyone who types the URL gets the product free. The fix is a few lines of server code.

Get launch notes