FREE TOOL · 3 MINUTES

Is your AI-built app ready for production?

Answer 15 yes/no questions and get your readiness score, plus a prioritised list of what to fix before real users find the problems for you.

No coding knowledge needed. Based on the checklist I use on client apps.

0 of 15 answered0%

Security

  1. 1. Are all secret API keys kept off the browser?

    View your page source and search for "sk_", "secret" or "api_key". Public keys (Stripe pk_, Supabase anon) are fine.

  2. 2. Are database access rules switched on (Supabase RLS / Firebase rules)?

    Log in as one user and try to fetch another user's record. If it works, the answer is no.

  3. 3. Are permissions checked on the server, not just by hiding buttons?

    If someone called your API directly, would the server stop them from doing things they shouldn't?

  4. 4. Is your Git history free of secrets?

    Keys that were committed once are still in old commits, even after you moved them to .env.

  5. 5. Is user input validated on the server?

    Browser-only validation can be skipped by anyone with dev tools.

Reliability

  1. 6. Will you get notified when something breaks?

    Error tracking like Sentry or PostHog, not finding out from an angry customer email.

  2. 7. Are login, sign-up and paid AI calls rate limited?

    Could one bot hit your OpenAI endpoint 10,000 times overnight?

  3. 8. Are backups running, and have you tested restoring one?

    A backup you've never restored is a hope, not a plan.

  4. 9. Are payments confirmed by webhook, not by the browser?

    If the browser says "payment succeeded" and your app trusts it, that message can be faked.

  5. 10. Do errors show friendly messages instead of stack traces?

    File paths, database names or SQL in an error page are a map for attackers.

Performance

  1. 11. Do your pages load quickly with realistic amounts of data?

    Fast with 10 test records is not the same as fast with 10,000.

  2. 12. Are your images resized and compressed?

    A 5 MB hero image will crawl on mobile. Check with PageSpeed Insights.

Maintainability

  1. 13. Does the code follow one consistent way of doing things?

    Or are there three different ways of fetching data from different prompting sessions?

  2. 14. Do sign-up, login, payment and your main feature have automated tests?

    You don't need 100% coverage, just the flows that would hurt most if they broke.

  3. 15. Does a human understand how the app works?

    If the only "person" who knows the codebase is an AI chat history, the answer is no.