Auditing an AI-generated app before launch: the five checks we run first

说明与用途

对 AI 生成的应用进行审核包括五个步骤：检测泄露的密钥、启用行级安全、保护公共端点、提升 SEO 与可访问性，以及优化移动性能。

问题

AI-generated apps often contain critical security, SEO, accessibility, and performance issues that can harm users and damage reputation if not identified before launch.

结果

Implementing the five checks reduces critical vulnerabilities by ~80%, improves SEO visibility, enhances accessibility for keyboard and screen reader users, and brings mobile performance to acceptable thresholds.

工作流

• 1. Scan client bundle for exposed secrets such as sk_, service_role, or other non-public keys.
• 2. Verify Supabase RLS policies are enabled on all tables and restrict access to authenticated owners.
• 3. Check .env files for committed keys and rotate any exposed keys.
• 4. Review Edge Functions and API routes for authentication checks, rate limiting, and input validation.
• 5. Test indexability by fetching the domain, inspecting meta tags, and validating sitemap.xml.
• 6. Run Lighthouse accessibility audit and perform keyboard navigation tests.
• 7. Measure mobile performance with Lighthouse, focusing on LCP, TBT, and CLS, and optimize images and bundles.

证据

We run audits on dozens of these projects, we've settled on five checks that catch roughly 80% of the critical issues.

来源

A project we audited last month had 14 tables in Supabase. Three of them had RLS disabled, including the one storing user emails and payment status.

来源

We audited a project that loaded a 4 MB hero image on its mobile homepage. The developer had dragged in a high-res photo and the AI never compressed it. LCP was 8 seconds on simulated 4G.

来源