--- title: "Can I launch this app safely?" description: "Most AI-built apps ship with open tables, leaked keys or unverified payments. Six checks to run before launch and when to get an audit." url: https://whocanfixmyapp.com/problems/can-i-launch-this-app-safely --- [Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Launch and safety](https://whocanfixmyapp.com/problems#launch-and-safety) # Can I launch this app safely? VC-67 · Any AI builder · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley) Quick verdict Partly fixable yourself. You can run the checks, fixing findings usually needs help. - **How serious**: High - **Fix it yourself?**: Partly, some steps need a developer - **Typical cost**: $49–$800 one-off check or audit ([prices](https://whocanfixmyapp.com/pricing)) - **Top rated**: [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 **What you see.** The app works and looks finished, but you have no way to tell whether real users and money are safe on it. ## Why it happens Working in preview says nothing about safety. The numbers show how common the gap is. A scan of 1,645 Lovable projects found 170 with tables anyone could read. An August 2026 scan of 30,998 live vibe coded apps found 57 percent of reachable Supabase-backed apps allowed unauthenticated table reads. In June 2026, 90 of 127 scanned AI-built apps had at least one critical finding. The reason is simple. The AI optimizes for the thing you asked for, a working screen. Security is invisible in the preview, so it is skipped. Supabase's own production checklist lists what gets missed: row level security on every table, email confirmation, custom SMTP, CAPTCHA, backups that are not downloadable on the Free Plan, and projects that pause after seven days of low activity. Add secrets in the browser and payments unlocked without a verified webhook, and you have the four areas a launch check must cover: data access, secrets, payments, operations. ## Fix it yourself 1. Open the Supabase **Security Advisor** and fix every rls disabled in public and auth users exposed finding. Those are open tables, see [data leak](https://whocanfixmyapp.com/data-leak). 2. Press F12 on the live site, open **Sources**, and search the code for `sb_secret_`, `service_role`, `sk_live` and any AI API key. Anything found is leaked and must be rotated. 3. Create two test accounts. Signed in as one, change the id in the URL to the other's record. If you can see or edit it, users can see each other's data. 4. Pay with a test card and confirm the account unlocks only after the webhook arrives, then test cancel and refund. See [paid but not upgraded](https://whocanfixmyapp.com/problems/stripe-webhook-not-firing-paid-but-not-upgraded). 5. Operations: a paid database plan with backups, custom SMTP, CAPTCHA on sign-up, error alerts, and a Git repository you own. 6. Work through the full [launch checklist](https://whocanfixmyapp.com/checklist). Any failed critical item means do not launch until it is fixed. ## When to get an engineer Get an audit when you cannot run these steps yourself, when any critical item fails, or when money or personal data is involved from day one. A one-off check or audit costs $49–$800 and takes one day to a week. You get a list of findings with severity and a fix estimate. Tell the engineer your builder, your database, your host, and whether payments are live. See [pricing](https://whocanfixmyapp.com/pricing) for what each band covers. ## Top-rated companies Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score). - 1 · [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 · Best for: A check before launch · Free first step · from $49 - 2 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490 - 3 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299 [All 79 companies, ranked](https://whocanfixmyapp.com/directory#ranking) ## Check these DATA-01 · Critical Access rules are on for every table In Supabase, open Table Editor: every table should show RLS enabled, with at least one policy. In Firebase, your rules should never say `allow read, write: if true`. DATA-02 · Critical No secret keys reach the browser Open your live app, then DevTools, Sources, and search the loaded JavaScript for `sb_secret_`, `sk_live_`, `sk-proj-` and `sk-ant-`. Older Supabase keys are long tokens starting with `eyJ`: decode the middle part of each on your own machine, and if it contains `"role":"service_role"`, your secret key is public. A publishable or anon key in the browser is expected. DATA-03 · Critical One user cannot open another user's records Sign in as user A, copy a request from the Network tab, and change the record ID to one that belongs to user B. You should get an error or an empty result. PAY-01 · Critical Paid accounts are unlocked by a verified payment webhook Access should change only when your server receives a signed webhook from Stripe or your provider, not when the browser reaches a success page. OPS-01 · Critical Database backups run automatically and a restore has been tested Check what your database plan actually includes, then restore a backup into a test project once. ## Questions ### The builder's own security scan passed, is that enough? Treat it as a start. In the CVE-2025-48757 case the builder's scanner only checked that a policy existed, not that it was correct. Run the checks above as well. ### How long does a launch check take? A day if you do the six steps yourself. A professional audit takes one day to a week and costs $49–$800 depending on the size of the app. Sources: [Statement on CVE-2025-48757](https://mattpalmer.io/posts/statement-on-CVE-2025-48757/); [vibe-eval: vibe coding security monthly, August 2026](https://vibe-eval.com/updates/vibe-coding-security-monthly-aug-2026/); [Launch Ready Code: state of vibe code security, June 2026](https://www.launchreadycode.com/resources/state-of-vibe-code-security-june-2026); [Supabase: production checklist](https://supabase.com/docs/guides/deployment/going-into-prod). **Same category** - [Bots and spam sign-ups are flooding the app](https://whocanfixmyapp.com/problems/bots-and-spam-signups-flooding-the-app) - [I only learn about outages from customers](https://whocanfixmyapp.com/problems/i-only-learn-about-outages-from-customers) - [Do I need a privacy policy for my vibe coded app?](https://whocanfixmyapp.com/problems/do-i-need-a-privacy-policy-for-my-app) [All launch and safety problems](https://whocanfixmyapp.com/problems#launch-and-safety) **Run every check** The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.