Ship your first app safely

Goal

Launch an app without leaking keys, data, or money

For

Founders and vibe coders shipping a first app

Steps

6

About

120 minutes

6 steps, in order. Sign in to keep track as you go.

1. 1

   Step 1: Pre-launch checklist for your first app

   Run it on your project to get a launch checklist built from your actual code: blockers, first-week items, and later.

   Passes on: A list of blockers to clear before launch

   Use in Claude
2. 2

   Step 2: Check your app for leaked API keys and secrets

   Check for keys in git history, tracked .env files, and secrets that reach the browser. Rotate anything it finds.

   Passes on: A clean repo, with leaked keys rotated

   Use in Claude
3. 3

   Step 3: Stop users seeing each other's data in Supabase

   If you use Supabase, prove that strangers and other users cannot read or change each other's rows.

   Passes on: Row level security fixes as migrations

   Use in Claude
4. 4

   Step 4: Secure your Stripe webhook against fake payments

   If you take payments, make sure nobody can fake a payment or get credited twice.

   Passes on: A webhook that checks signatures and ignores repeats

   Use in Claude
5. 5

   Step 5: Security audit for your web app before launch

   Get a written security review of the API, sign-in, and uploads. Fix the high items before launch.

   Passes on: A security review with a fix list

   Use in Claude
6. 6

   Step 6: Check your site works after every deploy

   Add a short test that checks the live site after every deploy, so you hear about breakage before users do.

   Passes on: A smoke test you run after each release

   Use in Claude