TL;DR: A real pre launch checklist SaaS founders can trust has 15 checks across four areas: security, reliability, performance, and monitoring. Every check below comes with the exact self-test, and most take under five minutes. AI tools like Lovable, Bolt, and Cursor ship working code, not safe defaults. This list is the gap between the two. Want the score first? Run the free scan on your live URL.
Most launch checklists ask "does the signup form work." That is the demo checklist. This is the production one. It covers what breaks after strangers arrive: open databases, leaked keys, silent outages, and slow pages under load.
Why vibe-coded apps need their own checklist
AI builders are great at features and silent on defaults. The data shows it. Symbiotic Security scanned 1,072 AI-built apps. 98% had at least one flaw. 16% had critical issues. CMU's SusVibes study found 61% of AI-written code carried at least one security flaw. And CVE-2025-48757 exposed 170+ Lovable apps through one shared gap: Row Level Security left off.
None of those apps looked broken. All of them were. That is why every check below tests the live app, the way a stranger would. Our vibe coding security guide covers the same ground in depth.
Security: checks 1–6
1. Row Level Security is on, with real policies
With RLS off, your public anon key can read every row in every table. A policy of USING (true) counts as off.
Self-test: run the free Supabase RLS checker against your live URL. No rows should come back without a login. Then read how RLS policies should look and scope each one to the row owner.
2. No secrets in the client bundle
The fastest AI-written code calls vendors from the frontend, key inline. That ships the key to every visitor.
Self-test: open your live app. View page source. Search for sk_live, service_role, and your vendor key prefixes. Nothing privileged should appear. Our guide on finding exposed secrets in AI bundles shows the full sweep.
3. Security headers are set
CSP, HSTS, X-Frame-Options, X-Content-Type-Options. They come from your host or server config. AI editors write neither.
Self-test: run your domain through the free security headers checker. All four core headers should be present.
4. Auth and API routes have rate limits
Without limits, a bot can try 10,000 passwords against your login. Our load engine reports this word for word as "No rate limiting detected under concurrent load." (k6Scanner.js:170). It is one of our most common findings.
Self-test: point the free API rate limit checker at your busiest endpoint. Or send 50 requests in 10 seconds yourself. Something should start refusing with a 429.
5. Config files return 404
Deploys that copy the whole project folder ship your notes to production. That includes .env, .git, and editor config files.
Self-test: open yoursite.com/.env, /.git/config, and /.cursorrules in a browser. Every one must return 404.
6. CORS is locked to your own domain
An API that answers any origin lets other sites call it as your users, and read the reply.
Self-test: send a request to your API with the header Origin: https://evil.example and read the response. If access-control-allow-origin echoes it back, your CORS is open. Our CORS guide has the exact curl command and the fix.
Reliability: checks 7–9
7. Error states render something
Users forgive a clear error. They do not forgive a blank white screen.
Self-test: open your app. Switch dev tools to offline mode. Click through the core flow. Every failure should show a message and a way back. No blanks, no spinners that never stop.
8. A vendor outage does not take you down
Your app depends on a payment vendor, an AI API, an email sender. Each one will have a bad day.
Self-test: in dev tools, block your payment or AI vendor's domain with request blocking. Run the flow. You want a clear "try again later," not a hang or a crash.
9. Backups exist and restore works
A backup you have never restored is a wish, not a backup.
Self-test: open your database host's dashboard and confirm a backup schedule is on. Then restore the latest backup into a staging project once. Time it. Now you know your real recovery time.
Performance: checks 10–12
10. The app loads on a slow phone
Your users are not all on fiber. Big AI-generated bundles hurt most on mobile.
Self-test: in dev tools, throttle the network to 3G. Hard-reload your landing and app pages. Count the seconds until you can act. If you get bored waiting, so will users.
11. Your busiest endpoint survives load
One user works fine. Fifty at once is where AI-written queries and missing caches show up.
Self-test: fire a burst of requests, all at once, at your busiest endpoint. A simple loop works. Watch how long replies take. If they climb fast and never recover, fix it before launch day traffic finds it.
12. List pages do not fire dozens of queries
The classic AI-generated bug: one page load runs one query per row. It feels fine with 10 rows in dev. It dies at 5,000 rows in production.
Self-test: open your database's query log, then load a list page once. You should see a handful of queries, not a flood of near-twins. Run EXPLAIN ANALYZE on the slowest and add the index it begs for.
Monitoring: checks 13–15
13. Errors reach a human
Most vibe-coded apps ship with no error tracking at all. So the first person to find a bug is a user. Or an attacker.
Self-test: throw one test error in production, on purpose. Confirm an alert lands where a human reads, within minutes. If nothing arrives, you are flying blind.
14. Uptime checks watch the paths that earn money
A homepage check tells you the homepage is up. Signup, login, and checkout can still be down.
Self-test: point uptime checks at your signup, login, and payment paths. Then point one at a fake path on purpose and confirm the alert fires. An alert you have never seen fire is check 9 all over again.
15. Logs survive long enough to matter
When something goes wrong, you will want to know what happened last week, not just last hour.
Self-test: try to pull a log line from 7 days ago. If you cannot, raise how long logs are kept. Do it before launch, while it is a setting and not a regret.
The whole list on one screen
| # | Check | 60-second self-test |
|---|---|---|
1 | RLS on, owner-scoped | Run the RLS checker. Zero rows without login. |
2 | No secrets in bundle | View source. Search sk_live, service_role. |
3 | Security headers | Run the headers checker. Four core headers present. |
4 | Rate limits | Run the rate limit checker. Expect a 429. |
5 | Config files 404 | Open /.env, /.git/config, /.cursorrules. |
6 | CORS locked down | Send a foreign Origin header. It must not echo back. |
7 | Error states render | Go offline in dev tools. Click through. No blank screens. |
8 | Vendor outage handled | Block the vendor domain. Expect a clear message. |
9 | Backups restore | Restore the latest backup to staging. Time it. |
10 | Loads on slow mobile | Throttle to 3G. Hard reload. Count seconds. |
11 | Survives load | Burst requests at once. Watch reply times. |
12 | No query floods | Load a list page. Count queries in the log. |
13 | Errors reach a human | Throw a test error. Confirm the alert arrives. |
14 | Uptime on money paths | Check signup, login, checkout. Test-fire one alert. |
15 | Logs retained | Pull a log line from 7 days ago. |
One legal check before you ship
Does your app have an AI feature and EU users? Then the EU AI Act's transparency rules under Article 50 apply from August 2, 2026. Users must be told they are talking to an AI. Fines for that breach run up to €15 million or 3% of global turnover. Our Compliance Wing runs 60 checks across GDPR, the EU AI Act, SOC 2 foundations, and ISO 27001 foundations, and the full Compliance Score report is $799.
What to do when checks fail
Do not fix in random order. Get the ranked list first.
- Run the free scan. $0. It covers these checks against your live URL and returns a score out of 100.
- Get the full audit if the score is low. The Launch Readiness Audit is $499 one time: every finding, a ranked fix plan with time estimates, and a benchmark against 200+ audited apps.
- Hand it off if you are not technical. Done-for-you setup is $1,999 with a named CTO, leading into a $2,999/mo plan. Monitoring plans run $149 to $599 a month if you just want daily scans and alerts.
FAQ
What should be on a pre launch checklist for SaaS in 2026?
Fifteen checks across four areas: security (RLS, secrets, headers, rate limits, config files, CORS), reliability (error states, vendor outages, backups), performance (mobile load, load handling, query health), and monitoring (error alerts, uptime checks, log retention). Each one can be self-tested in minutes.
How do I check my Supabase RLS without touching code?
Run our free Supabase RLS checker against your live URL. It tests whether your tables answer to the public anon key. If rows come back without a login, RLS is off or your policies are too loose. The fix goes in the database, not the frontend.
Do I need this checklist for a small MVP?
Yes, especially then. AI-built MVPs are the most likely to skip access control, rate limits, and alerts. The list is also shortest before launch. Fifteen checks on a small app take an afternoon. The same gaps found after a breach take much longer.
What is the fastest check to run first?
View your page source and search for key prefixes like sk_live or service_role. It takes two minutes and catches the single worst gap: a secret key shipped to every visitor's browser. Then run the free scan for the other fourteen.
Does the EU AI Act affect my SaaS launch?
If your app has an AI feature and EU users, yes. Article 50 transparency rules apply from August 2, 2026. Users must be told they are talking to an AI. Fines for that breach run up to 15 million euros or 3% of global turnover.
What does it cost to get all fifteen checks done for me?
The scan that covers them is $0. The full audit report with a ranked fix plan is $499, one time. If you want the fixes implemented for you, done-for-you setup is $1,999 with a named CTO, leading into a $2,999/mo plan.
The pattern across all 15 checks is one sentence: your app works, but nobody set the defaults. The AI took you 80% of the way. This checklist is the other 20%, and every item on it is testable today, for free. Start with the scan. Work the list. Then ship.