Is your app ready for real users?Ten questions, two minutes.

01Database rules

Does every table in your database have rules that limit who can see each row?

In Supabase this is row-level security; in Firebase, security rules. AI tools often leave them off or too open.

02Data between users

Have you checked, signed in as one customer, that you can't see another customer's data?

Two test accounts, then try to open the other account's orders, files or messages.

03Secret keys

Are your secret keys (Stripe, OpenAI, the database admin key) only on the server, never in the website's code?

Anything that starts with VITE_ or NEXT_PUBLIC_ ends up in the browser, where anyone can read it.

04Payments

Are orders marked paid only when Stripe confirms it to your server, not by the page customers land on after paying?

The confirmation should come from a Stripe webhook your server checks, not from a success page.

05Server checks

Does every server function check who is asking before it does anything?

Edge functions, API routes and server actions. Hiding a button in the app doesn't stop someone calling the function.

06Errors

Would you hear about an error before a customer tells you?

An error tracker such as Sentry, or alerts by email or Slack when something fails.

07Going back

If a change breaks the app, can you go back to the last working version in a few minutes?

The code in Git, a deploy you can repeat, and ideally a staging copy to try changes first.

08Backups

Is your database backed up, and have you ever restored a backup to check it works?

Free plans often keep only a short history, or none. A backup you've never restored is a guess.

09Others can change it

Could a developer who isn't your AI tool change one screen without breaking another?

Logic kept in one place, types switched on, and files small enough to read.

10Google

Does Google show your public pages when you search for them?

Search site:yourdomain.com. Apps that build every page in the browser often show up blank to Google.