Make the launch URL boringly public
Your public URL should load over HTTPS, return useful HTML, avoid broken redirects, and not depend on a logged-in session.
AI app launch checklist
Before you post the link, check the public surface.
A practical checklist for apps built with Lovable, Bolt, Replit, Cursor, Claude Code, and coding agents. Use it before Product Hunt, Hacker News, Reddit, LinkedIn, or your first buyer demo.
Public URL
Auth and data
Payments and trust
Launch blockers
The checklist
See the paid report formatRemove accidental noindex and robots blockers
Many AI-built launches still carry staging defaults. Check robots tags, canonical URLs, sitemap basics, and social preview metadata.
Search the public bundle for secrets and maps
Look for exposed secret-looking keys, source map references, debug artifacts, and public config that explains too much about your backend.
Verify Supabase, Firebase, and auth boundaries
Client-side project URLs are normal. Weak rules are not. Test two users, row-level security, storage rules, and admin-only actions.
Add basic security headers
Before sending launch traffic, review CSP, frame protections, content sniffing, referrer policy, and permissions policy.
Make checkout and trust copy visible
If money changes hands, buyers need clear pricing, support, refund language, privacy, terms, and what happens immediately after payment.
Test mobile and first-load clarity
A launch visitor should understand the product, find the primary action, and avoid layout overlap on a normal phone viewport.
Keep a fix prompt for every blocker
The fastest path from warning to shipped fix is a precise task you can paste into Cursor, Lovable, Bolt, Replit, Claude Code, or your agent workflow.