Pre-launch security checklist for AI-built apps

AI coding tools write working code fast, and they tend to make the same security mistakes: skipping checks that make errors go away, putting keys where they're convenient, and trusting whatever the browser sends. Work through this list before launch. Each item links to the fix.

To fix with AI, paste a guide into your coding tool and say: "Find anything in this project that matches the Bad pattern and fix it like the Good one."

Secrets and keys (guide)

1. No API keys or passwords written into code.
2. No server key with a public prefix (NEXT_PUBLIC_, VITE_ and others).
3. No .env file committed, and .env* listed in .gitignore. Any key that was ever committed, even if since deleted, has been rotated.
4. No LLM key used in browser code.

Database (guide)

1. Row-level security turned on for every table in the public schema.
2. No policies that use true, or only check that someone is logged in, on tables that belong to users.
3. Every update policy has a with check.
4. Roles read from app_metadata or a roles table, never user_metadata.
5. Views created with (security_invoker = true).
6. security definer functions read the user from auth.uid(), and anon can't call them.
7. No admin client used just to get past a permission error.
8. Private files in private buckets, with per-user folder policies.

API routes and server actions (guide)

1. Every route and server action checks who is calling. Middleware alone isn't enough.
2. getUser() or getClaims() on the server, never getSession().
3. Records loaded by ID are checked against the caller.
4. Only expected fields are accepted (validated with a schema).
5. Redirects after login stay on your own site.

Payments (guide)

1. Webhooks verify Stripe's signature.
2. Access is granted in the webhook, not on the success page.
3. Each webhook event can only take effect once.
4. Prices and plans come from the server, never the request.

AI features (guide)

1. User input never goes into the system prompt.
2. Model output is never rendered as raw HTML or run as code or SQL.
3. Agent tools are narrow, run with the user's permissions, and need a click for anything irreversible.
4. AI endpoints need a login and have a rate limit.

Checking it automatically

Seaworthy checks items 1 to 6, 12 (public buckets), 13, 15, 18 and 21 to 23 automatically, on your own machine, including keys in git history, plus part of 24 (tools that run shell commands, write files or run code without a guard) and part of 25 (the rate limit). It also checks open Firebase rules, CORS, SQL injection, vulnerable dependencies, packages that don't exist on npm, MCP configs and security headers. The rest of the list needs a person for now. Run it with:

npx seaworthy-cli

The full list of rules says exactly what each one checks. This checklist reduces common risks. It is not a security audit or a guarantee.

All guides