You built an app over a weekend with Lovable, Bolt, Replit or Cursor. It works, the demo looks great, and you are about to share the link. Before you do, spend an hour on the boring stuff. AI tools are good at making things work. They are much less good at making things safe, because "safe" never shows up in a demo.

This is the checklist I run before any AI-built app gets real users. It is ordered by how often the problem bites, and none of it needs a security background.

1. Look for secrets in your front end

Anything your browser downloads is public. In Vite projects, every variable starting with VITE_ ends up in the JavaScript bundle. In Next.js it is NEXT_PUBLIC_ . If a Stripe secret key, an OpenAI key or a Supabase service_role key sits behind one of those prefixes, anyone can copy it.

Open your deployed site, view the source, and search the JavaScript files for sk_ , service_role and api_key . If you find a real secret, rotate it first and then move the call to a server function.

2.…