The vibe-coded app launch checklist

Before you share your Cursor, Lovable or Bolt app, run through these checks. ShipAudit's free check does most of them automatically.

1. No secrets in the browser

Search your built JavaScript for sk_live_, service_role, OpenAI and AWS keys. Only publishable/anon keys belong client-side. Make sure /.env and /.git/ return 404.

2. Security headers

Set HTTPS with HSTS, Content-Security-Policy, X-Content-Type-Options: nosniff, a frame-ancestors or X-Frame-Options rule, and a Referrer-Policy.

3. Google basics

Every page needs a unique title and meta description, one H1, a canonical URL, Open Graph tags, a sitemap.xml and a robots.txt that doesn't block you.

4. Show up in ChatGPT and Perplexity

Allow OAI-SearchBot, ChatGPT-User, PerplexityBot and Claude-SearchBot in robots.txt, add an llms.txt summary, and use JSON-LD structured data. Make sure key content is in the HTML, not only rendered by JavaScript.

5. Payments and legal

Use Stripe Checkout or Payment Links (never a secret key in the frontend), and publish Terms, Privacy and a refund policy before you take money.

6. Fix it fast

Each ShipAudit finding comes with a copy-paste Cursor prompt. Run the free check