Free checklist
Ten checks for an app built with AI
The ten things a senior analyst looks at first in an app built with Lovable, Bolt, Replit, Cursor or tools like them, in plain English. Read them here, take the five-minute self-check, or keep the printable PDF next to your desk.
Get the printable checklist
One email with the checklist. Nothing else.
The checks
The ten checks
A check covers what any visitor’s browser can see. A review covers all ten.
Secrets and packages
Keys left in your code, where anyone can copy them (payment keys, database master keys, AI keys), and packages your AI tool added that don’t exist, are out of date or have known holes.Database rules
Who can read and change your users’ data. In Supabase this is row-level security; in Firebase, your security rules.Sign-in
Whether protected pages and actions really are protected, whether one customer can reach another’s account, and whether repeated sign-in attempts are limited. Tested with two test accounts and an anonymous visitor, not assumed from reading the code.Payments
Whether Stripe’s payment messages are checked, and what happens on a failed payment, a refund or a cancelled plan, and that a payment message received twice is only counted once.Security settings
The protections your server should send with every page, and a certificate that’s set up properly.Personal data
What you collect, where it’s kept and who can see it, so you can answer a customer’s question about their data.Backups
Whether backups are on, and whether you could actually get your data back after a bad day.Running costs
Spending limits, including hard caps on AI model calls, and the calls that grow with every user, so the first warning isn’t the invoice.Errors and monitoring
Whether you find out about problems before your users do.Releases
How a change reaches your users, and how to undo it if something breaks.
Self-check
The five-minute self-check
Ten questions about your app. Every gap links to its check above.
Next
Want a second pair of eyes?
A senior analyst checks your live app from the outside, with your permission, and sends you the three biggest risks within one working day. £49, and yours to keep.