Auditing an AI-generated app before launch: the five checks we run first

Description and use

Auditing AI-generated apps involves five steps: detecting exposed secrets, enabling row-level security, securing public endpoints, improving SEO and accessibility, and optimizing mobile performance.

Problem

AI-generated apps often contain critical security, SEO, accessibility, and performance issues that can harm users and damage reputation if not identified before launch.

Outcome

Implementing the five checks reduces critical vulnerabilities by ~80%, improves SEO visibility, enhances accessibility for keyboard and screen reader users, and brings mobile performance to acceptable thresholds.

Workflow

• 1. Scan client bundle for exposed secrets such as sk_, service_role, or other non-public keys.
• 2. Verify Supabase RLS policies are enabled on all tables and restrict access to authenticated owners.
• 3. Check .env files for committed keys and rotate any exposed keys.
• 4. Review Edge Functions and API routes for authentication checks, rate limiting, and input validation.
• 5. Test indexability by fetching the domain, inspecting meta tags, and validating sitemap.xml.
• 6. Run Lighthouse accessibility audit and perform keyboard navigation tests.
• 7. Measure mobile performance with Lighthouse, focusing on LCP, TBT, and CLS, and optimize images and bundles.

Evidence

We run audits on dozens of these projects, we've settled on five checks that catch roughly 80% of the critical issues.

Source

A project we audited last month had 14 tables in Supabase. Three of them had RLS disabled, including the one storing user emails and payment status.

Source

We audited a project that loaded a 4 MB hero image on its mobile homepage. The developer had dragged in a high-res photo and the AI never compressed it. LCP was 8 seconds on simulated 4G.

Source