A 10-minute security checklist before you launch your AI-built app

You built something with an AI tool and it works. Before real users sign up, spend ten minutes on these seven checks. They match what Greenlight Scan looks for.

1. No secret keys in your code

Search your live JavaScript for sk-, sk_live, service_role and PRIVATE KEY. Any hit means: rotate the key, move the code to the server. See our post on keys in JavaScript.

2. Row Level Security is on for every table

If you use Supabase, every table in the public schema needs RLS and a sensible policy. Otherwise anyone with your public key can read your users. Details: Supabase RLS in plain English.

3. Firebase rules are not open

Firebase rules that say allow read, write: if true let anyone read and write your database or storage. Rules should check request.auth != null at a minimum, and usually that the user owns the data.

4. Nobody can download your .env or .git folder

Visit https://your-site.com/.env and https://your-site.com/.git/config. Both should return “not found”. If either shows content, remove it from what you publish and rotate every key that was inside.

5. API routes need a login

Open the pages of your app while signed out and look at the network requests. If a request like /api/users returns real data without you being signed in, that route needs an authentication check on the server.

6. Your API does not trust every website

A CORS setting of * together with cookies or tokens lets any other website read your API on behalf of your visitor. Allow only your own domain.

7. Basic security headers are set

Add HTTPS-only (HSTS), clickjacking protection and a Content-Security-Policy. They cost nothing and block whole classes of attacks.

Then what?

Fix the critical items first (keys, open databases, exposed files), then the rest. Re-test after every fix. The free preview of Greenlight Scan runs the passive checks for you in about 2 minutes, and the full scan covers the deeper ones after you prove you own the site.

A clean result is not a guarantee that your app is secure. It means the common, automatic mistakes are gone, which is what most attackers look for first.