TL;DR: A real launch readiness checklist is not a to-do list. It is a score. Rate your app out of 25 on each of four dimensions — security, reliability, performance, and monitoring — and add it up. The average AI-built app we scan gets 42/100. Under 60 means you built something that works, not something launch-ready. This page gives you the full rubric to score yourself today.
Most founders think "ready to launch" means the features work. Click the button, the thing happens, ship it. That is functional readiness. It is not launch readiness.
The gap between those two is where launches die. The app that leaks no data but falls over at 50 users. The app that runs fine but loses half its signups to a slow first page. The app that breaks on a Tuesday and nobody finds out until Friday. Each one passed a features-work test. None of them were ready.
One note on scope. This is a scoring framework, not a task list. It will not hand you fifteen commands to run tonight. It will tell you where you stand, in one number, the same way our free scan does.
Why a launch readiness checklist has four dimensions, not one
Security gets the headlines. It is one quarter of the job.
We score every app on the same four areas, and each one fails in its own way:
- Security fails loud and public. Leaked data, hijacked accounts, a breach write-up with your name in it.
- Reliability fails at the worst hour. The backup that was never tested. The deploy with no way back. It shows up the day a launch post takes off.
- Performance fails in silence. Users do not file a ticket about a slow page. They close the tab and never come back.
- Monitoring is the gap that hides the other three. Without it, your users are your alert system, and they resign without notice.
If you shipped with Lovable, Bolt, Cursor, or v0, the pattern is sharper. AI builders make the working feature and skip the rails around it. The numbers say this is the norm, not the exception: Symbiotic Security scanned 1,072 AI-built apps. 98% had at least one flaw. CMU's SusVibes study found flaws in 61% of AI-written code. Across the 100 apps we scanned, the average score was 42/100.
So score all four. Here is the rubric.
The scoring rubric: 25 points per dimension
Each area below has five checks. Each check is worth 5 points. Score 5 if it is true and tested. Score 3 if it is half true. Score 0 if it is not there or you do not know. Not knowing is a 0 — that rule keeps the score honest.
Security — score /25
| Check | Points |
|---|---|
Database rules (RLS) are on for every table, and every policy is owner-scoped — no USING (true). Test yours with the free RLS checker. | 5 |
| No secret key appears in your page source or client bundle. View source and search for your key prefixes. | 5 |
| Every API route checks auth on the server. Nothing trusts the frontend's word for who is logged in. | 5 |
| Auth, password reset, and API routes have rate limits. Test one with the rate limit checker. | 5 |
| Security headers are set: CSP, HSTS, X-Frame-Options. Check yours with the headers checker. | 5 |
Why the first row matters most: CVE-2025-48757 exposed 170+ Lovable-built apps through open database rules alone. Our RLS guide shows how to close that gap in an afternoon.
Reliability — score /25
| Check | Points |
|---|---|
| Backups run on a schedule, and you have restored one at least once. A backup you never restored is a hope, not a plan. | 5 |
| You can roll back a bad deploy in minutes, and you know the exact steps. | 5 |
| Failed calls to outside services retry or fail loud. One vendor outage does not take your whole app down. | 5 |
| One user — or one bug — cannot flood the app to death. Load limits exist on the paths that write data. | 5 |
| What your terms promise matches what your host really offers for uptime. | 5 |
None of this is glamorous. All of it is the difference between a bad night and a dead company.
Performance — score /25
| Check | Points |
|---|---|
| Your first page loads fast on a phone, on mobile data — not just on your office wifi. | 5 |
| Queries have been tested past a few hundred rows. Test data hides slow queries. Real growth finds them. | 5 |
| The API holds up when many users hit it at once, not just one tester clicking around. | 5 |
| Hot paths have no N+1 query patterns, and the columns they filter on have indexes. | 5 |
| Production ships no dev leftovers: no source maps, no debug output, no config files at public paths. | 5 |
Monitoring — score /25
| Check | Points |
|---|---|
| If the app goes down, an alert reaches you within minutes. Not hours. Not from a user. | 5 |
| Errors are tracked with stack traces — not just a "500" in a log file nobody reads. | 5 |
| Alerts reach a human who will act. An alert channel nobody watches scores 0. | 5 |
| You have logs you can search when something breaks, and they do not leak user data. | 5 |
| If signups broke silently right now, you would know within the hour. | 5 |
Monitoring is the area founders skip most, because it never feels urgent while things work. It is also the only one that tells you when the other three fail. Under load, the most common finding our scanner reports, word for word, is: "No rate limiting detected under concurrent load." (k6Scanner.js:170). Founders never see it coming — because nothing was watching.
What your total score means
| Total /100 | Verdict | What to do |
|---|---|---|
| 0–40 | Below the average. Real gaps in more than one area. | Do not launch yet. Fix security zeros first, this week. |
| 41–60 | The average zone — our scans sit right here at 42. Working, but not ready. | Close every 0-point row. Re-score in two weeks. |
| 61–84 | Close. Often one whole area lagging — usually monitoring. | Fix the lagging dimension. Verify with a re-scan. |
| 85–100 | Launch-ready, if you scored honestly. | Launch. Keep scanning so the next deploy does not slide you back. |
Two rules for reading your number. First, a strong area cannot carry a weak one. A 25/25 on security does not help you the night your only backup fails to restore. Second, most founders grade their own security row too kindly. If you did not test a check, it is a 0.
The legal layer the rubric cannot score
The rubric covers the technical side. The legal side is its own gate, and it is pass or fail.
If you have EU users, GDPR applies to you. Where your users live sets the duty — not where your office sits. Fines run up to €20 million or 4% of global revenue. AI builders never wire in the privacy layer: the lawful basis checks, the rules for how long you keep data, the consent records. Our GDPR guide for vibe-coded apps covers what is missing.
If your product has an AI chatbot or AI-made content, the EU AI Act's Article 50 rules apply from August 2, 2026. Users must be told they talk to an AI. Fines reach €15 million or 3% of global turnover. The EU AI Act guide for SaaS founders walks through it, and the Compliance Wing checks both layers against your live app.
How to get scored without doing the math
You can run this rubric yourself in an hour. Or you can have it run for you in about a minute.
The free scan takes your live URL — no code access, no install — and returns a Launch Readiness Score out of 100 across the same four areas. It is the same /100 gauge this rubric mirrors. The scan is platform-aware. It spots when an app was built with Lovable, Bolt, Cursor, v0 and others, and it probes the defaults each builder tends to leave open. Our methodology page shows how the score is built.
If the scan finds real gaps, the Launch Readiness Audit ($499, one time) turns them into a branded report: every finding tagged P0 to P3, a ranked fix plan with time costs, and a benchmark against 200+ audited apps. You can read a full sample report first to see the format.
For the deeper security context behind the rubric's first table, the vibe coding security guide maps the OWASP Top 10 to AI-generated code.
Get your score in about a minute
Scan your live URL free. Security, reliability, performance, monitoring — one score out of 100, and the gaps that are holding it down.
Run the free scan — $0FAQ
What should be on a launch readiness checklist for a SaaS product?
Four dimensions: security, reliability, performance, and monitoring. Each one has its own failure mode. Most founders only check the first. An app can leak no data and still fall over at 50 users, or break silently with nobody watching.
How do I score my app's launch readiness?
Score each of the four dimensions out of 25 using five checks worth 5 points each. Add them up for a total out of 100. Give full points only for items that are done and tested, not just planned.
What is a good launch readiness score?
The average across 100 AI-built apps we scanned was 42/100. Anything under 60 means you are launching functional, not launch-ready. 85 and above, honestly scored, is ready. Most apps land far below where their founders expect.
Is passing a security check enough to be launch-ready?
No. Security is one dimension of four. Reliability failures show up the day traffic spikes. Performance problems show up as users who quietly leave. And without monitoring, you learn about every failure from an angry email.
Do I need GDPR compliance if my company is not in the EU?
Yes, if you have EU users. Your users' location triggers the duty, not your office address. A US founder with EU signups still owes them GDPR rights, and an AI chatbot adds EU AI Act Article 50 duties from August 2, 2026.
Can I check my launch readiness without sharing code?
Yes. A free URL-based scan scores your live app out of 100 across all four dimensions in about a minute. No code access and no install. It tests what is publicly exposed, which is where a real attacker starts.
Features working was the easy 80%. The rubric above is the missing 20% — and it is the part your first paying customers will actually feel. Score yourself, fix the zeros, and launch knowing your number.