>_ launch check

Run these checks before your app goes live

Open tables and leaked keys stay invisible until someone finds them. Pick your tool, tick each check as you confirm it, and open the fix for anything that does not pass.

Your ticks are kept in this browser only, separately for each tool, so you can come back mid-way.

0 of 14 checked

Secrets and API keys

Make sure no secret API keys ship to the browser
Open your live app in an incognito window, open DevTools, and search the Sources panel for sk-, service_role and SECRET. The only key you should find is the public anon key.
Read the fix
Keep secret and service role keys on the server only
Find each call that uses a secret key (OpenAI, Stripe secret, Supabase service role) and check it runs in a server or edge function. In the Network tab, the browser should call your endpoint, not the provider.
Read the fix

Database access

The database checks cover Supabase only. If your app uses a different database, check its own access rules.

Turn on Row Level Security for every table
In the Supabase SQL editor, run SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public'; and check that no table shows false in the rowsecurity column.
Read the fix
Test your tables the way a signed-out stranger would
Query each table that holds user data with only the anon key and no session, using the check in the fix guide. The request should be refused or return only rows you mean to be public.
Read the fix
Check that saving data actually reaches your database
Submit a form in your app, then refresh that table in the Supabase Table Editor. The new row should be there, and the supabase.co request in the Network tab should return 200 or 201, not 401 or 403.
Read the fix

Deploy and hosting

Copy every environment variable to your deploy host
Compare your builder's secrets with your host's environment variable settings (Netlify, Vercel or similar). Every name should match exactly. Redeploy, then check the live console for undefined errors.
Read the fix
Add your Replit Secrets to the deployment itself
Open the deployment's own settings, not the workspace Secrets pane, and check that every variable your app reads is listed with its production value. Redeploy after adding any.
Read the fix
Confirm your live app has the data and tables it needs
In the Database pane, open the production view. Check its tables and columns match development after your last publish, and add any rows you need live directly to production.
Read the fix
Make sure uploaded files survive a redeploy
Upload a test file on the live URL, redeploy with no code changes, and check the file is still there. If it is gone, your app is saving to the local disk instead of Object Storage.
Read the fix
Open your live URL and check the page actually loads
Open the deployed URL in a fresh incognito window with the browser console open. The page should render with no red errors, and the main screens you click into should load too.
Read the fix

Sign-in

Test sign-in on the live app, not just the preview
On your deployed URL (your custom domain too, if you have one), open a fresh incognito window, log in from scratch, and refresh. You should stay signed in, and logging out and back in should work.
Read the fix
Add your live domain to the sign-in redirect URLs
In Supabase, open Authentication, then URL Configuration, and check the Site URL and Redirect URLs include your live domain with https. On Replit, register the deployed URL with your sign-in provider too.
No fix page yet

Errors and limits

Check that every package your AI added is real
For each unfamiliar package in package.json or requirements.txt, open its npm or PyPI page. It should link to a real repository and have a maintainer history and steady downloads.
Read the fix
Set spending caps or alerts on paid AI and API keys
Open the billing or usage settings for each paid AI or API service your app calls, and check that a monthly spending limit or a usage alert is switched on.
No fix page yet