Vier Checks vor dem Launch einer mit KI gebauten App
KI-Coding-Tools liefern schnell eine funktionierende App, scheitern aber oft an Sicherheits- und Qualitaetspruefungen. Vor jedem Launch lohnt ein Blick auf vier Punkte, etwa offen exponierte API-Keys und Secrets.
AI coding tools get you to a working app fast. They are less good at the unglamorous parts that decide whether it is safe to put in front of real users. Before I launch anything built with Cursor, Lovable, Claude or ChatGPT, I check the same four things.
API keys have a habit of ending up in the repo: pasted into a config file to "just get it working", committed, and forgotten. Search the whole repo, including old commits, for anything that looks like a key, token or connection string. If a secret has ever been committed, treat it as leaked and rotate it. Deleting the line is not enough, because it stays in the history.
A database that works in development is often wide open: no row-level rules, public read access, or a default admin account. Check who can read and write each table or collection when you are not logged in at all. If the answer is "anyone", fix it before launch.
It is easy for the page to hide a button while the API behind it still answers anyone. For every endpoint that changes or returns user data, confirm the server checks who is asking, and that they are allowed to see that record, not just that they are logged in.
Check that prices and amounts are decided on the server, not trusted from the browser. Confirm that a payment is only treated as successful when your payment provider's webhook says so, and that a failed or repeated webhook cannot give someone free access or charge them twice.
You can do all of this by hand, and it is worth doing once so you know what you are looking for. Reading a whole repo for it every time gets tedious, so I built a tool for it: Quick Scan First. It scans a GitHub repository for exposed keys, open databases, missing auth checks and payment bugs, then opens a pull request with a proposed fix. You review the pull request and approve every change. It does not store your code. There are 3 free scans and 2 free fixes, and Pro is from £10 a month plus VAT.
Disclosure: I made Quick Scan First. The checklist above works with or without it.