# Last Mile: The Launch Kit for Vibe-Coded Apps

> A pre-launch checklist and prompt pack for apps built with AI coding tools (Cursor, Claude Code, Codex, Lovable, Bolt, Replit). 100 checks in 14 sections and 43 copy-paste prompts turn your AI coding agent into a pre-launch auditor. Standard $9 / Pro $19 at launch (normally $12 / $24). Sold on Gumroad. Version 1.1, updated Oct 15, 2026.

## Pages
- [Home](https://last-mile-kit.vercel.app/): product, pricing, FAQ
- [Pre-launch check](https://last-mile-kit.vercel.app/check): free public URL scanner for headers, secret patterns in JS, exposed .env/.git, source maps, basic SEO
- [Free checklist preview](https://last-mile-kit.vercel.app/checklist-preview): non-negotiables and 15 of 100 checks
- [Guides](https://last-mile-kit.vercel.app/guides): SEO articles on RLS, shipping safely, Stripe webhooks, leaked keys, launch checklist
- [Buy on Gumroad](https://skotbot.gumroad.com/l/yrpthn): Standard and Pro

## Guides
- [Supabase RLS checklist before launch](https://last-mile-kit.vercel.app/guides/supabase-rls-checklist): A practical Row Level Security checklist for Supabase before you take real users or payments. Policies, service role, storage, and how to test.
- [How to ship a Cursor or Claude Code app safely](https://last-mile-kit.vercel.app/guides/ship-cursor-claude-code-safely): A practical safety workflow for apps built with Cursor or Claude Code: ground rules, audit-first prompts, secrets, auth, and a launch order.
- [Stripe webhooks not working in production](https://last-mile-kit.vercel.app/guides/stripe-webhooks-production): Fix the usual reasons Stripe webhooks fail in production: wrong signing secret, parsed body, success-page fulfillment, local vs live keys, and how to verify.
- [Leaked API keys in your frontend bundle: how to check](https://last-mile-kit.vercel.app/guides/leaked-api-keys-frontend-bundle): How to find API keys that accidentally shipped in your JavaScript bundle, what counts as a true secret vs a public token, and how to rotate safely.
- [A vibe-coded app launch checklist](https://last-mile-kit.vercel.app/guides/vibe-coded-app-launch-checklist): A practical launch checklist for AI-built apps: secrets, auth, Stripe, backups, monitoring, and when to get a human. Built for Cursor, Claude Code, Lovable, Bolt and Replit.
- [Lovable and Bolt app security before launch](https://last-mile-kit.vercel.app/guides/lovable-bolt-app-security): A pre-launch security pass for apps built with Lovable or Bolt: Supabase policies, secrets, edge functions, payments, and how to test without a terminal.
- [Supabase anon key exposed: is it a problem?](https://last-mile-kit.vercel.app/guides/supabase-anon-key-exposed): Found your Supabase anon or publishable key in the browser? It's public by design. Here's when it's fine, when it's dangerous, and what to check.
- [Payment success-page bypass: verify payments server-side](https://last-mile-kit.vercel.app/guides/payment-success-page-bypass): If visiting /success unlocks paid features, anyone can skip checkout. How the bypass works, how to test for it, and how to verify Stripe payments on the server.

## Sections covered in the kit
Secrets & env vars; auth & permissions; database & data validation; error handling & logging; performance; deploy; domain, DNS & SSL; payments with Stripe; analytics; legal basics; backups; monitoring; docs & handoff; AI features.

## FAQ
### What is Last Mile?
Last Mile: The Launch Kit for Vibe-Coded Apps is a pre-launch checklist and prompt pack: 100 checks in 14 sections and 43 copy-paste prompts that turn your AI coding agent into a pre-launch auditor. It costs $9 (Standard) or $19 (Pro) at launch, normally $12 and $24.

### Do I need to know how to code?
You need to read a diff and follow steps. If you don't use a terminal, checks that need one carry "No terminal?" notes, and prompt P42 walks your builder through any check.

### Which tools does it work with?
Cursor, Claude Code, Codex, Lovable, Bolt and Replit.

### Does it guarantee my app is secure?
No. It catches the common, costly mistakes. Checking every box lowers your risk. It does not guarantee your app is secure. It is practical guidance, not legal, tax or professional security advice.

### What's the difference between Standard and Pro?
Standard ($9 launch, $12 regular) includes the 28-page PDF, checklist.md, prompts.md and the changelog. Pro ($19 launch, $24 regular) adds drop-in agent rules files for Cursor, Claude Code and Codex plus a paste-in version for Lovable, Bolt and Replit, stack editions of the six highest-risk prompts for Next.js + Supabase + Stripe and React + Firebase + Stripe, and every v1.x and v2 update.

### Do I get updates?
Yes. Buyers get every v1.x update free by email through Gumroad. Pro buyers also get v2.

### Refunds?
Full refund within 14 days, no questions. Reply to your Gumroad receipt to ask for one.

### How do I get help?
Reply to your Gumroad receipt.