ShipReady Guides

Fix guides for vibe-coded apps

Short, practical fixes for the mistakes AI builders make most: leaked keys, open databases, runaway API bills and launch pages that look unfinished. Each guide ends with a free scan of your live site.

13 guidesLovable · Bolt · Cursor · v0 · Next.js · Vite

Start here

The launch checklist for vibe-coded appsEvery security, cost and polish check to run before you post the link, in one page.

Keys and secrets

Rotate a leaked API keyYour key shipped or got committed. Revoke it in the right order, then check what it was used for.Which env variables are safe in the browserNEXT_PUBLIC_, VITE_ and friends publish values to every visitor. Here's what's fine and what isn't.Keep your Stripe secret key server-sideWhy sk_live must never reach the browser, and how to move Stripe calls to a server route.Hide your OpenAI key in Next.jsHow keys leak through NEXT_PUBLIC_ variables, and the proxy-route pattern that fixes it.

Database

Is my Lovable app secure?A quick check for Lovable, Bolt and other Supabase-backed apps: tables, keys, functions, storage and auth.Turn on row-level security in SupabaseWhat RLS is, the SQL to turn it on, and how to test whether your tables are open right now.

Costs and abuse

Rate limit your AI API routeYour key is safe on the server, but anyone can still call your endpoint in a loop. Here's how to stop it.Add auth to your Next.js API routesAdd a session check to every route handler before someone scripts your endpoint.

Launch polish

Remove console.log from productionDebug logs leak data and look unfinished. Strip them at build time and keep real errors.Turn off public source mapsPublic .map files let anyone rebuild your original source code. Check yours and turn them off.Replace the default title and favicon"Vite + React" in the browser tab says unfinished. Fix the title, favicon and icons in five minutes.Open Graph images that don't look brokenThe OG tags every launch needs, at 1200x630, so your link previews look finished.

Check your live site in 60 seconds

ShipReady scans your deployed URL and the JavaScript visitors actually download: leaked keys, Supabase exposure, unprotected API routes, titles and share images. Secret findings unlock only after you verify you own the site.

Free scan, no signup, no code upload.