Launch checklist for a vibe-coded app: security, pricing, legal

An AI assistant can get an app working in a weekend. It will not, by default, make that app safe to put in front of strangers who pay you. This launch checklist for a vibe-coded app covers what to check before you share the link: security basics, a real pricing page, legal pages, uptime checks, analytics, onboarding, and where to list it.

Work through it in order. Security comes first because mistakes there are the hardest to undo.

1. Secrets and keys

Generated code often puts API keys wherever they make the demo work. Check every one.

1. Search the built frontend for secrets. Build the app, then search the output folder for "sk_", "secret", "api_key", "token" and your provider names. Anything in the browser bundle is public.
2. Know which variables are public. In Next.js, any variable starting with "NEXT_PUBLIC_" is sent to the browser. In Vite it is "VITE_". Only publishable keys belong there, such as a Stripe publishable key or a Supabase anon key.
3. Move paid API calls to the server. If your app calls an AI model, an email service or a paid API, the call must go through your backend. A leaked model key can run up a large bill within hours.
4. Check your git history. A key deleted in a later commit is still in the history. If a secret was ever committed, rotate it at the provider. Rewriting history is not enough.
5. Set spending limits at every provider that offers them: AI APIs, cloud hosting, email.

2. Auth and data access

1. Check authorisation on the server for every request. Hiding a button in the UI is not access control. Try loading another user's record by changing the ID in the URL or API call. It must fail.
2. If you use Supabase, turn on Row Level Security for every table, and write policies. Without it, the public anon key can read and write every row.
3. Use a maintained auth library or service rather than generated custom auth code. Better Auth, Supabase Auth and Clerk are common choices; hosting a SaaS cheaply covers their free tiers.
4. Hash passwords with bcrypt, scrypt or Argon2 if you store them at all. Email codes or magic links avoid storing passwords entirely.
5. Set session cookies to "HttpOnly", "Secure" and "SameSite=Lax" or stricter.
6. Validate input on the server, not only in the form. Check types, lengths and allowed values.

3. Rate limits and abuse

1. Rate-limit sign-in, sign-up and password reset by IP and by account. A few attempts a minute is enough for real users.
2. Rate-limit anything that costs you money: AI calls, emails, file uploads, exports.
3. Cap upload sizes and check file types on the server.
4. Put a cap on free usage. One script on a free plan can cost more than all your paying users bring in.
5. Add a bot check such as Cloudflare Turnstile to sign-up if you see fake accounts.

4. Backups and recovery

1. Turn on automatic database backups. On a VPS with SQLite, Litestream streams changes to object storage. On managed Postgres, check that your plan includes backups. Some free plans do not.
2. Restore a backup once before launch. A backup you have never restored is a guess.
3. Keep a copy outside your main provider. If your account is suspended, backups in the same account go with it.
4. Write down how to redeploy from scratch: which env vars, which commands, which DNS records. Ten lines in a private note is enough.

5. Dependencies and basics

1. Run your package manager's audit ("npm audit" or the equivalent) and fix high-severity issues.
2. Check that every package exists and is the one you meant. AI tools sometimes suggest package names that do not exist or that look like popular ones. Install only packages you can find on the registry with a real history.
3. Serve everything over HTTPS and redirect HTTP.
4. Turn off debug mode and verbose errors in production. Stack traces should go to your logs, not the browser.
5. Set basic security headers: Content-Security-Policy where practical, "X-Content-Type-Options: nosniff", and a sensible "Referrer-Policy".

6. A real pricing page

A pricing page is part of the product, not a placeholder. Before launch:

1. Show every plan with a real price, the billing period, and whether tax is included.
2. Show limits in numbers.
3. Make cancelling easy and say how.
4. Test the full checkout with a real card, then refund yourself.
5. Check that webhooks work: a successful payment upgrades the account, and a cancellation or failed payment downgrades it.

At $1–5 a month, payment fees can take a third of a $1 charge. See How to price a SaaS at $1–5 a month and Payment fees on $1–5 subscriptions before you set prices.

7. Legal pages

You need at least three pages, linked from the footer and the checkout:

• Privacy policy. What personal data you collect, why, who processes it (hosting, email, payments, analytics), how long you keep it, and how to ask for deletion. If you have users in the EU or UK, GDPR applies to you even if you are not based there.
• Terms of service. What users can and cannot do, what happens to accounts that break the rules, limits of liability, and how you handle changes.
• Refund policy. One or two plain sentences. For example: "Full refund within 14 days, no questions asked."

Merchant-of-record providers such as Paddle and Lemon Squeezy review your site before approving payouts, and expect to see these pages. Generated templates are a starting point. Read them, remove what does not apply, and get legal advice if you handle sensitive data such as health or financial records.

If you use non-essential cookies for analytics or ads, you may need a consent banner in some regions. Cookie-free analytics avoid most of this.

8. Uptime checks

1. Add an external uptime check on your homepage and one API health endpoint. UptimeRobot's free plan gives 50 monitors at 5-minute intervals and allows commercial use. Better Stack's free tier includes 10 monitors and a status page. Prices as of October 2026.
2. Send alerts somewhere you will see them, such as your phone, not an inbox you check weekly.
3. Make the health endpoint check the database, not only that the server responds.
4. Watch your free-tier limits. Some hosts pause or spin down apps on free plans. An uptime check will tell you, but it is better to know the limits in advance.

9. Analytics and errors

1. Use simple, privacy-friendly analytics. Cloudflare Web Analytics is free. Plausible starts at $9 a month for 10,000 pageviews, as of October 2026. Umami is open source and can be self-hosted.
2. Track four numbers from day one: visitors, sign-ups, people who complete the main action once, and paying customers.
3. Add error tracking so you hear about crashes before users email you. Many error-tracking services have free plans for small apps.
4. Log server errors with enough context to reproduce them, without logging passwords, tokens or full card details.

10. Onboarding

1. Get a new user to the first useful result in under two minutes. Count the steps and remove any that are not needed.
2. Use an example or sample data so the first screen is never empty.
3. Ask for as little as possible at sign-up. Email is usually enough.
4. Send one welcome email with a single link back into the app and a real reply-to address.
5. Watch three strangers use it without helping them. Fix the first place each one gets stuck.

11. The final hour

1. Open the app in a private window on a phone and a laptop.
2. Sign up, complete the main action, pay, cancel, and delete the account.
3. Check that emails arrive and do not land in spam. Set up SPF, DKIM and DMARC for your sending domain.
4. Check page titles, descriptions and a social preview image.
5. Add a contact address you will answer.

Where to list it

Start with a few places where your users already are: a relevant subreddit or forum, Show HN if people can try the app without signing up first, and one or two launch platforms. Free SaaS directories that are worth your time lists the options and what each one gives you. If your app is cheap, One Dollar SaaS is one of the places built for it.

List your app

If your app costs $5 a month or less to start, you can list it on One Dollar SaaS for free.