AI-built app production readiness checklist
AI coding tools — Cursor, Lovable, Bolt, Replit, v0, Windsurf — make it fast to build and ship, and just as fast to launch with leaked keys, an open database, or a missing defence. This checklist walks the 74things ShipReady checks on a live site, grouped in the order you’d work through them before launch. Each item links to a page explaining what it means and how to fix it.
It’s generated from the scanner itself, so it always matches exactly what runs against your site. Start at the top — secrets and database access are where the launch-day disasters live.
01Secrets & API keys23
The most common and most damaging mistake in AI-built apps: a real credential shipped into client JavaScript or a committed .env served publicly. Treat anything found here as already compromised — rotate it, then move it server-side.
- Anthropic API Key Exposedcritical
- AWS Access Key Exposedcritical
- Cloudinary API Secret Exposedcritical
- Database Connection String Exposedcritical
- Exposed environment file (.env)critical
- GitHub Token Exposedcritical
- Groq API Key Exposedcritical
- Hugging Face Token Exposedcritical
- npm Access Token Exposedcritical
- OpenAI API Key Exposedcritical
- Perplexity API Key Exposedcritical
- Private Key Exposedcritical
- PyPI API Token Exposedcritical
- Replicate API Token Exposedcritical
- Resend API Key Exposedcritical
- SendGrid API Key Exposedcritical
- Slack API Token Exposedcritical
- Stripe Secret Key Exposedcritical
- Supabase Service Role Key Exposedcritical
- Mapbox Secret Token Exposedhigh
- Potential Secret or Private Token Exposedhigh
- Slack Incoming Webhook URL Exposedhigh
- Stripe Restricted Key Exposedhigh
02AI coding-tool exposure5
Files and keys AI builders leave behind — tool config and instruction files served to the public, and provider keys inlined into the browser bundle. They map your stack for an attacker and hand over working credentials.
03Database & backend access5
Whether your Supabase or Firebase backend actually enforces access control. A missing Row Level Security policy or a public storage bucket means anyone with the public key in your JavaScript can read — or change — your data. Building on Supabase? See the focused Supabase checklist. Supabase security checklist →
04HTTPS & TLS3
That connections are encrypted, modern and forced. Deprecated TLS versions and a missing HTTP→HTTPS redirect leave traffic open to downgrade and interception.
05Security headers9
The response headers browsers rely on to contain attacks — Content-Security-Policy, HSTS, X-Content-Type-Options and more. Rarely exploitable alone, but their absence weakens every other defence.
- Missing Content-Security-Policy headerhigh
- Missing or permissive X-Frame-Options headermedium
- Missing Strict-Transport-Security headermedium
- Invalid Referrer-Policy valuelow
- Missing or invalid X-Content-Type-Options headerlow
- Missing Referrer-Policy headerlow
- Response header discloses a software versionlow
- Strict-Transport-Security is missing includeSubDomainslow
- Weak Strict-Transport-Security max-agelow
06Cookies & sessions4
That session cookies carry the flags keeping them out of JavaScript and off unencrypted connections. Missing HttpOnly, Secure or SameSite turns an XSS or CSRF bug into a full session takeover.
07Information disclosure9
Internal files and endpoints that should never be reachable in production — an exposed .git directory or source map, a debug endpoint, a stack trace, a directory listing, or CORS that trusts any origin. Each hands an attacker reconnaissance or data.
- Exposed .git Directoryhigh
- Exposed docker-compose filehigh
- Overly Permissive CORS with Credentialshigh
- Directory Listing Enabledmedium
- Error page leaks a stack tracemedium
- Exposed Debug or Config Endpointmedium
- GraphQL introspection is enabled in productionmedium
- Exposed .DS_Store filelow
- Exposed JavaScript Source Maplow
08Payments2
That a live site charges through live payment credentials. A test-mode Stripe key on production means real checkouts look like they work but silently collect no money.
09Email deliverability & anti-spoofing6
The DNS records that let your transactional email arrive and stop others forging your domain — SPF, DKIM, DMARC and MX. Missing records send password resets to spam and let anyone phish your users from your own address.
10Launch readiness5
The basics that signal a finished product rather than a preview: a real 404 page, a robots.txt and sitemap, page metadata, and no leftover starter-template branding.
11SEO & AI visibility3
Whether search engines and AI assistants can reach your pages at all — a stray noindex or a rule blocking AI crawlers can make a finished site invisible.
Check your site against the whole list
ShipReady runs every check here across up to ten pages of your live site and reports what it finds, with a paste-ready fix for each. Free, no signup.