הריצו את הבדיקות האלה לפני שהאפליקציה עולה לאוויר

Secrets and API keys

• Make sure no secret API keys ship to the browser

  Open your live app in an incognito window, open DevTools, and search the Sources panel for sk-, service_role and SECRET. The only key you should find is the public anon key.

  לתיקון
• Keep secret and service role keys on the server only

  Find each call that uses a secret key (OpenAI, Stripe secret, Supabase service role) and check it runs in a server or edge function. In the Network tab, the browser should call your endpoint, not the provider.

  לתיקון

Database access

The database checks cover Supabase only. If your app uses a different database, check its own access rules.

• Turn on Row Level Security for every table

  In the Supabase SQL editor, run SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'; and check that no table shows false in the rowsecurity column.

  לתיקון
• Test your tables the way a signed-out stranger would

  Query each table that holds user data with only the anon key and no session, using the check in the fix guide. The request should be refused or return only rows you mean to be public.

  לתיקון
• Check that saving data actually reaches your database

  Submit a form in your app, then refresh that table in the Supabase Table Editor. The new row should be there, and the supabase.co request in the Network tab should return 200 or 201, not 401 or 403.

  לתיקון

Deploy and hosting

• Copy every environment variable to your deploy host

  Compare your builder's secrets with your host's environment variable settings (Netlify, Vercel or similar). Every name should match exactly. Redeploy, then check the live console for undefined errors.

  לתיקון
• Add your Replit Secrets to the deployment itself

  Open the deployment's own settings, not the workspace Secrets pane, and check that every variable your app reads is listed with its production value. Redeploy after adding any.

  לתיקון
• Confirm your live app has the data and tables it needs

  In the Database pane, open the production view. Check its tables and columns match development after your last publish, and add any rows you need live directly to production.

  לתיקון
• Make sure uploaded files survive a redeploy

  Upload a test file on the live URL, redeploy with no code changes, and check the file is still there. If it is gone, your app is saving to the local disk instead of Object Storage.

  לתיקון
• Open your live URL and check the page actually loads

  Open the deployed URL in a fresh incognito window with the browser console open. The page should render with no red errors, and the main screens you click into should load too.

  לתיקון

Sign-in

• Test sign-in on the live app, not just the preview

  On your deployed URL (your custom domain too, if you have one), open a fresh incognito window, log in from scratch, and refresh. You should stay signed in, and logging out and back in should work.

  לתיקון
• Add your live domain to the sign-in redirect URLs

  In Supabase, open Authentication, then URL Configuration, and check the Site URL and Redirect URLs include your live domain with https. On Replit, register the deployed URL with your sign-in provider too.

  אין עדיין עמוד תיקון

Errors and limits

• Check that every package your AI added is real

  For each unfamiliar package in package.json or requirements.txt, open its npm or PyPI page. It should link to a real repository and have a maintainer history and steady downloads.

  לתיקון
• Set spending caps or alerts on paid AI and API keys

  Open the billing or usage settings for each paid AI or API service your app calls, and check that a monthly spending limit or a usage alert is switched on.

  אין עדיין עמוד תיקון