The free Ground Crew checklist
Your app shipped. Check these before your users do.
If you built your app or site with Lovable, Bolt, Replit, v0, or Base44 and it now has real users, this is the list to work through. AI builders optimize for the demo, so the failures that hurt in production are almost never in the features. They are in the layer underneath: who can read your database, which keys your site hands to every visitor, where a password reset actually lands. Six groups, in the order we check them on every audit. Run it yourself in an afternoon, or have us run it for you, free, with the findings reproduced and written up.
01 Data access and row-level security
- Row-level security is on for every Supabase table holding user data, and the policies are tested with a second account, because a policy that exists but was never exercised is a guess.
- Firebase rules are read line by line for the development leftovers, especially any rule that grants reads to everyone.
- API routes check ownership, not just login. If changing an ID in the URL returns another customer's record, that is the IDOR pattern, and it is the most common serious finding we see.
- Storage buckets do not allow public listing, and file paths are not guessable sequences.
02 Keys and secrets
- The client bundle is scanned for secret keys: Stripe secret keys, OpenAI keys, Supabase service-role keys, anything that belongs on a server only. Your site hands its bundle to every visitor, so anything in it is public.
- Publishable and secret keys are told apart properly. The Supabase anon key in the browser is normal; the service-role key beside it is a breach waiting for a timestamp.
- Test and live credentials live in separate variables, and the repo history is checked, because a key committed once is a key that exists forever.
03 Auth flows
- The auth provider's site URL and redirect allowlist point at your live domain, not the preview domain or localhost. This one mismatch is the single most common reason new users get stranded after confirming their email.
- The full journey is walked with a fresh account: sign-up, confirmation, first login, password reset, logout, and a second device.
- Login and reset endpoints slow down under repeated attempts, and their error messages do not reveal which email addresses hold accounts.
04 Payments and webhooks
- Every webhook endpoint verifies signatures. An endpoint that trusts any POST can be told a payment succeeded when it did not, and that is a five-minute attack once someone looks.
- Webhook target URLs match the live domain, and the subscribed events match what the app actually depends on.
- Retried events are handled idempotently, so a duplicate delivery does not grant a subscription twice or send three receipts.
- The prices in checkout match the prices on your marketing pages, in amount, interval, and currency.
05 Transport and headers
- HTTPS is enforced everywhere, the certificate is valid with comfortable days to expiry, and HSTS is present.
- Security headers are set deliberately: Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and frame protection.
- Session cookies carry Secure, HttpOnly, and SameSite flags.
- CORS is not a wildcard on any endpoint that answers authenticated requests.
06 Operations and recovery
- A crash in production tells somebody. If the only error report is a user emailing you a screenshot of a white screen, you are the monitoring.
- Uptime and certificate-expiry alerts exist, and they go to a person who will act on them at 2 AM, not a dead inbox.
- Backups exist, run automatically, and at least one restore has actually been tested. An untested backup is a hope, not a backup.
- Dependencies are checked for known vulnerabilities and for platform API versions approaching deprecation.
Rather not run it yourself?
That is the trade this service exists for. The audit is free, read-only, and run by a person: we work this exact checklist against your live app, reproduce every finding before it goes in the report, and hand you the report with a flat quote for anything you want fixed. If it comes back clean, we tell you that and charge you nothing. Request your free audit.