Your Lovable, Bolt or Replit App Works. Is It Safe to Launch? A 10-Minute Check (2026)

You did it. You typed a few prompts, and now there's a real app on your screen with a login page and a dashboard. It feels like magic, and honestly it kind of is.

This is also the most dangerous moment in the whole project. The preview works because you are the only user. Nothing has pushed back on it yet.

We spend a lot of time on apps that failed once real users arrived. The problems are rarely clever. They're boring and they're predictable, which is good news, because it means you can check for them in about ten minutes.

Two things that actually happened

Lovable and Supabase. Security researcher Matt Palmer scanned 1,645 showcase apps and found around 170 where the database could be read, and in some cases written to, with the public key that ships in every browser. Emails, addresses and occasionally API keys were sitting there. The vendor disputes how serious the CVE is. Its position is that each app owner is responsible for their own data rules. That's the part to take seriously: nobody else is going to check yours.

Replit and SaaStr. In July 2025, founder Jason Lemkin was running a public vibe-coding experiment when Replit's agent deleted a live production database during a code freeze, then told him it couldn't be restored. He recovered the data himself. Replit's CEO called it unacceptable, and the company has since added separation between dev and production databases.

Neither story means these tools are bad. They mean the tool builds, you still have to verify.

Can you launch? Follow the arrows

The five checks, in plain English

1. The two-account test (3 minutes)

Make two accounts. Create something as user A. Open a private window and log in as user B. Now try to reach A's stuff by editing the ID in the page address, or by watching the Network tab in your browser's developer tools.

If B can see anything of A's, your app is hiding data with the screen but not blocking it on the server. That's the Lovable problem in one sentence.

2. The secrets hunt (2 minutes)

Open your live app, press F12, go to Sources or Network, and search for sk_, service_role, secret and Bearer. Then do the same in your code repo.

Public keys (a Stripe publishable key, a Supabase anon key) are meant to be public. Anything marked secret or service role is not. If one shows up in the browser, treat it as leaked. Rotate it today.

3. The backup drill (2 minutes to check, 20 to do)

A backup you haven't restored is a hope, not a backup. Find where your database backups live, restore the latest one into a separate test project, and check that the data is there.

This is the Replit lesson. The AI doesn't need to be evil to ruin your week. It just needs access.

4. The 2am test (2 minutes)

Add free error tracking (Sentry has a free tier) and an uptime monitor that pings your site. Send yourself the alerts. Right now, if your payment webhook silently fails, you'll learn about it from an angry email.

5. The ownership test (1 minute)

Can you download the full project, database schema included, and run it on your own machine? If the answer is "I'm not sure", find out now. Platform pricing changes and platforms shut down, and being locked in is a business risk, not a technical detail.

What the AI tools tend to skip

That right-hand column is not a knock on the tools. It's just not what a prompt like "build me a booking app" asks for.

So, DIY or call someone?

Do it yourself if the app is small, the data isn't sensitive, and you've run the five checks and passed. Honestly, that's a lot of apps.

Get a person involved if any of these ring true:

• you're taking payments or storing personal, health or financial data;
• your fixes keep breaking something else;
• you've re-prompted the same bug more than three times;
• you've failed check 1, 2 or 3 and aren't sure how to fix it.

That last group is why we run a vibe coder rescue service. A single fix like Stripe, auth or a custom domain is usually $80 to $200. A proper hardening pass (access rules, error handling, tests) is around $600 to $1,800. Hourly work is $20. A full rebuild of something badly broken is $1,800 to $5,000 or more, and we'll tell you after a short audit whether it's actually worth rebuilding.

If you'd rather talk it through first, book a free call. No pitch, just a straight answer on whether your app is ready.

Sources for the incidents: reporting on CVE-2025-48757 (researcher Matt Palmer's disclosure, via Superblocks and CVE databases) and coverage of the July 2025 Replit incident by eWeek and TechTarget.