How to prepare an AI-generated app for launch

Freeze the scope

Write down the routes a customer can reach and the tables those routes touch. New features wait. Launch work is auth, data access, the one slow query, error handling, and a deploy you can roll back.

Check these before you take payment

RLS enabled and tested with two users. No service-role key in client code. Webhooks idempotent. Secrets only on the server. Errors do not print SQL or stack traces to the user. The build passes with strict TypeScript.

Bolt.new and Lovable apps often skip the webhook and the second-user test because the demo uses one account. That is the test that finds the leak.

Then measure

Record LCP, the slowest API, and the error rate on the first day. If you cannot name those numbers, you are not ready to scale the ad spend.