Auditing an AI-generated app before launch: the five checks we run first

Описание и применение

Проверка AI‑сгенерированных приложений включает пять шагов: поиск утечек секретов, включение RLS, проверка публичных эндпоинтов, улучшение SEO и доступности, а также оптимизацию мобильной производительности.

Задача

AI-generated apps often contain critical security, SEO, accessibility, and performance issues that can harm users and damage reputation if not identified before launch.

Результат

Implementing the five checks reduces critical vulnerabilities by ~80%, improves SEO visibility, enhances accessibility for keyboard and screen reader users, and brings mobile performance to acceptable thresholds.

Рабочий процесс

• 1. Scan client bundle for exposed secrets such as sk_, service_role, or other non-public keys.
• 2. Verify Supabase RLS policies are enabled on all tables and restrict access to authenticated owners.
• 3. Check .env files for committed keys and rotate any exposed keys.
• 4. Review Edge Functions and API routes for authentication checks, rate limiting, and input validation.
• 5. Test indexability by fetching the domain, inspecting meta tags, and validating sitemap.xml.
• 6. Run Lighthouse accessibility audit and perform keyboard navigation tests.
• 7. Measure mobile performance with Lighthouse, focusing on LCP, TBT, and CLS, and optimize images and bundles.

Доказательства

We run audits on dozens of these projects, we've settled on five checks that catch roughly 80% of the critical issues.

Источник

A project we audited last month had 14 tables in Supabase. Three of them had RLS disabled, including the one storing user emails and payment status.

Источник

We audited a project that loaded a 4 MB hero image on its mobile homepage. The developer had dragged in a high-res photo and the AI never compressed it. LCP was 8 seconds on simulated 4G.

Источник