You've been prompting for days (or weeks). Your app built with Cursor, Claude, ChatGPT, Bolt, or Replit Agent finally works. You're ready to ship it to real users.
But should you?
Vibe coding is incredible for building fast. But AI-generated code often has issues that only surface in production, with real users and real data. Use this checklist to make sure your app is actually ready.
How to Use This Checklist
Go through each section before launch. Items are organized by priority:
- Critical — Must fix before launch. Security and data loss risks.
- High — Should fix before launch. User experience and reliability issues.
- Medium — Fix soon after launch. Maintenance and scalability concerns.
🔴 Security (Critical)
- No API keys, passwords, or secrets in source code
- Environment variables used for all credentials
.envfile is in.gitignore- All API routes require proper authentication
- Users can only access their own data (no IDOR vulnerabilities)
- Password hashing uses bcrypt or argon2 (not MD5/SHA1)
- SQL queries use parameterized statements (no string concatenation)
- User input is sanitized before rendering (XSS protection)
- File uploads validate type and size
- HTTPS is enforced in production
- Cookies have Secure, HttpOnly, and SameSite flags
- Rate limiting on authentication endpoints
🔴 Data Protection (Critical)
- Database has automated backups enabled
- Backup restoration has been tested
- Sensitive data is encrypted at rest
- No PII logged in application logs
- Delete functionality actually removes data (not just soft delete if not intended)
🟡 Error Handling (High Priority)
- Production errors don't expose stack traces to users
- Errors are logged to a monitoring service (Sentry, LogRocket, etc.)
- Graceful error messages shown to users
- Failed API requests don't crash the app
- Network errors are handled with retry logic or user feedback
- Form validation errors are clear and helpful
🟡 Performance (High Priority)
- Page load time is under 3 seconds
- Database queries use indexes on filtered/sorted columns
- No N+1 query problems (check with query logging)
- Lists and tables have pagination
- Images are compressed and properly sized
- Large images use lazy loading
- Bundle size is reasonable (check with build analyzer)
- Static assets have caching headers
🟡 User Experience (High Priority)
- Loading states shown during async operations
- Success/error feedback after user actions
- Forms prevent double submission
- Mobile responsive design works properly
- Navigation works correctly (no broken links)
- User can recover from errors without refreshing
- Logout works and clears session properly
🔵 Code Quality (Medium Priority)
- No unused dependencies in package.json
npm auditoryarn auditshows no critical vulnerabilities- Console.log statements removed from production code
- Dead code and unused files removed
- Environment-specific configs properly separated
- README documents how to run the project
🔵 Deployment & Operations (Medium Priority)
- Build process completes without errors
- Environment variables configured in production
- Domain and SSL certificate configured
- Uptime monitoring in place
- Know how to access production logs
- Rollback plan if deployment fails
- Database migrations run automatically or documented
🔵 Legal & Compliance (Medium Priority)
- Privacy policy in place if collecting user data
- Terms of service if needed
- Cookie consent banner if required (GDPR)
- Third-party licenses are compatible with your use
The Most Commonly Missed Items
Based on hundreds of vibe-coded app reviews, these are the items developers miss most often:
- Exposed API keys — Check your git history too, not just current code
- Missing auth on API routes — AI often forgets to protect endpoints
- No rate limiting — Attackers can brute-force your login
- Verbose error messages — Don't show stack traces in production
- No input validation — Trust nothing from the client
- Missing database indexes — Fine with test data, terrible with real data
- No backups — One mistake and your data is gone
What If You Can't Check Everything?
At minimum, complete all Critical items before launch. These protect you from security breaches, data loss, and legal liability.
High priority items should be addressed within the first week of launch. Medium priority can wait a bit longer, but don't ignore them.
Not Sure If You're Ready?
Our Sanity Check service reviews your vibe-coded app against this checklist and more. Get a professional go/no-go assessment before you ship.
Get a Sanity Check ($99)After Launch
Shipping is just the beginning. Plan for:
- Monitoring — Set up alerts for errors and downtime
- User feedback — Have a way to collect bug reports
- Regular backups — Test them periodically
- Dependency updates — Security patches come out regularly
- Performance monitoring — Watch for degradation as data grows
Vibe coding lets you build incredibly fast. This checklist helps you ship with confidence. Good luck with your launch!
Bookmark this page and go through it before every launch. Or better yet, let us do the checking for you.