Max ZeshutGet a Launch Check

Is your app ready for real customers?

The Launch Scorecard is 20 yes/no questions about your AI-built app: database rules, keys, payments, domain, email, backups and monitoring. It takes about 3 minutes. Your score and your three most serious risks show right here; you don't have to give your email.

If you don't know the answer to a question, pick "No, or not sure": that's usually the honest answer.

0 of 20 answered

1. Is row level security (or your database's access rules) on for every table with user data?
2. Have you tested, with two accounts, that one user can't see another user's records?
3. Are all secret keys (OpenAI, Stripe secret, service role) kept out of the browser code?
4. Is your repository free of committed .env files, including in old commits?
5. If a key was ever exposed, have you rotated it at the provider?
6. Does every API route or function check who is calling before it reads or changes data?
7. Do payments grant access only through a Stripe webhook on your live domain?
8. Does your webhook check Stripe's signature before trusting the message?
9. Does access end automatically when a subscription is cancelled or a payment fails?
10. Is the app on your own domain, with HTTPS, and one address redirecting to the other?
11. Do sign-in, password reset and payment return links all land on your own domain?
12. Do sign-in emails come from your own domain through a real email service?
13. Do new users have to confirm their email address?
14. Is your database backed up every night, somewhere besides the database provider?
15. Have you ever restored a backup, even to a test project?
16. Do development and production use separate databases?
17. Do you get notified when the app throws an error?
18. Do you get an alert within minutes if the site goes down?
19. Are sign-up, forms and AI calls rate-limited?
20. Could another developer take over the app from a written handoff?

Answer all 20 to see your score. Nothing is sent anywhere until you choose to email it.