Home › Guides › Before you ship

Before you ship an AI-built app

Models write happy-path code. Review these four areas yourself (or with a second tool) before real users arrive.

1. Auth. Confirm sign-up, sign-in, password reset and session expiry actually work. If you use a managed auth product (e.g. data & backends like Clerk, Supabase Auth or Firebase Auth), check redirect URLs and allowed origins.
2. Database permissions. Row-level security and security rules are easy to leave open. Test as a second user: can they read or write someone else's rows?
3. Secrets. API keys belong in environment variables / a secret store, not in the client bundle or a public repo. Rotate anything that was pasted into a chat.
4. Payments. If you charge money, walk through a real test payment and a refund path. Merchant-of-record options and processors are listed under payments.

Related: hosting, email for transactional mail, and the full directory.