Confirm the app is production-ready, not just demo-ready
Check the public URL for noindex, placeholder pages, missing social metadata, weak trust copy, and Supabase/Firebase hints that should trigger a rules review.
For AI-built app launches
Lovable, Bolt, Replit, Cursor, Claude Code, and agent workflows can get an app public fast. Before launch traffic arrives, make sure the public URL is not carrying staging defaults, exposed config hints, weak headers, or missing buyer-trust pages.
Check the public URL for noindex, placeholder pages, missing social metadata, weak trust copy, and Supabase/Firebase hints that should trigger a rules review.
Look for source map references, debug artifacts, public config that reveals too much, and secret-looking strings that should never ship to the browser.
Make sure the deployed app loads over HTTPS, has stable redirects, hides development-only routes, and does not depend on a private workspace session.
Agent-assisted changes can leave small deployment gaps. Review CSP, HSTS, frame protections, content sniffing, referrer policy, and checkout/support paths.
Fast buyer path
Full finding list Exact evidence Copyable prompts for your AI coding tool Markdown report Launch checklist Before/after scorecard for sharing