A vibe-coded app launch checklist

Your app runs on a preview URL. Friends can click around. Launch is the moment real users and real money show up. This checklist is the short version of what usually breaks first.

“Vibe coded” here means: you built most of it with an AI coding agent or an AI app builder, and you may not have read every line. That is fine. Launch still has a minimum bar: safe, honest, recoverable.

Non-negotiables (do these even if you skip everything else)

• No secret API keys in source or in the browser bundle; rotate anything pasted into chats.
• Server-side auth on every route that reads or writes user data; users cannot access each other’s records.
• If you use Supabase/Firebase style client database access, RLS or security rules are on.
• Server-side input validation.
• If you take payments: fulfill from verified Stripe webhooks only; verify signatures.
• At least one backup restore tested.
• Uptime or error alert that reaches your phone.
• Spend caps on model APIs and other metered services.
• If the app has AI tools that can write, email, or spend: those actions use the same permission checks as a normal request; model output is treated as untrusted.

You can paste a public URL into /check for a fast pass over headers, public .env/.git, and secret-looking strings in JS. It covers roughly a dozen surface checks, not the full list.

Day-before launch order

1. Freeze. Commit, push, branch. Note the current production deploy.
2. Secrets. Scan repo + built assets + git history. Production env vars set in the host.
3. Auth. Two-user IDOR test. Logged-out test on private routes.
4. Payments. Test-mode purchase on staging; confirm webhook grants access; confirm success URL alone does not.
5. Preview walkthrough. Phone, slow network, empty states, error states.
6. Legal basics. Privacy policy that matches what you actually collect; terms if you charge.
7. Monitoring. Error tracker + uptime on / and a health route.
8. Go live. Domain, HTTPS, live Stripe keys, turn off debug routes.

Section map (so you know what “done” means)

• Secrets and env — client vs server boundary; boot-time validation of required env.
• Auth and permissions — session checks, roles, rate limits on login and expensive endpoints.
• Database — migrations, not hand-edited prod schema; pagination; safe rendering of user content.
• Errors and logs — no stack traces in the browser; no secrets in logs.
• Performance — mobile Lighthouse not red on the landing and home screens.
• Deploy / DNS / SSL — clean production build; domain in your account with auto-renew.
• Stripe — see the webhooks guide.
• Analytics — a few events that matter, not twenty vanity events.
• Backups and monitoring — restore test; spend caps.
• AI features — tool calls are authorized; outputs sanitized.

Who this is not enough for

If you process health records, children’s data, or move money between users, this checklist is a starting point, not a green light. Pause and get qualified help. Same if you cannot explain your permission model in plain language.

Keep the agent helpful

Load ground rules: audit first, one fix at a time, no surprise dependency adds, no secrets in files. Ship with Cursor, Claude Code, Codex, Lovable, Bolt, or Replit — the safety steps stay the same.

Want the expandable version with 100 checkboxes and 43 copy-paste prompts? Start with the free preview or buy Last Mile (Standard $9 at launch).

Launch-day hour-by-hour

• T-24h: Audit branch merged; preview signed off on phone; backups verified.
• T-2h: Freeze merges; double-check live env vars; Stripe live webhook endpoint enabled.
• T-0: Point DNS if needed; smoke test signup, core action, and a $1 test purchase if applicable; watch error tracker for 30 minutes.
• T+1h: Skim server logs for 500s and auth failures; confirm spend caps did not trip from a loop.
• T+24h: Read the first user emails yourself; file anything scary into a hotfix branch, not a drive-by agent rewrite.

After launch, keep the list alive

Checklists rot when platforms change. Revisit Stripe, auth provider, and host settings every few months. When your agent adds a new feature that calls a model tool or writes to the database, run the AI-features and auth sections again. The cost of a half-hour re-audit is lower than an emergency key rotation on a Saturday.

If you want a maintained pack with prompts tied to each check, that is what Last Mile is for. The preview shows the shape before you buy.

Related guides

• Leaked API keys in your frontend bundle: how to check

  If a secret can call a paid API or bypass your database rules, it does not belong in JavaScript the browser downloads. Here is how to find leaks fast and what to do when you find one.

• Supabase RLS checklist before launch

  If your vibe-coded app talks to Supabase from the browser, Row Level Security is the difference between “users see their own data” and “anyone with the anon key reads the whole table.”

• Stripe webhooks not working in production

  Most “Stripe works in test, breaks in prod” reports are the same few mistakes. Fulfillment on the success page, the wrong webhook secret, or a body parser that breaks signature verification.

Get launch notes