Security checklist for apps built with Bolt, Cursor, v0 and Replit
AI tools write working code fast, but they optimise for "it runs", not "it's safe". Go through this list before you share your app.
Keys
- No secret key in frontend code or in NEXT_PUBLIC_ / VITE_ variables.
- No .env file committed to Git, and no keys in old commits.
- Every key that ever leaked has been rotated, not just deleted.
Database
- Supabase: RLS on for every table, service_role key only on the server.
- Firebase: rules are not in test mode, reads and writes require auth.
- No database connection string (postgres://, mongodb+srv://) in the frontend.
Server and hosting
- /.env, /.git/config and backup files return 404.
- Security headers set: Content-Security-Policy, Strict-Transport-Security, X-Frame-Options.
- Android builds are not debuggable and don't allow cleartext traffic.
Run the whole list in one go
SafeCheck checks every item above on your website, GitHub repo or Android app and gives you an A to F grade for free.
Check your app now. Free, no signup, under a minute.
Scan your appMore guides: Is my Lovable app secure? A 5-minute check · How to check if Supabase RLS is enabled (and fix it) · Firebase test mode rules: how to tell if your database is open · How to check if your website leaks API keys · OpenAI API key exposed in your frontend? Do this now · Is this Claude skill or MCP server safe to install? A 5-minute check