Security Checklist

1. Real authentication — Proper sign-in, sessions and password handling — not a mock login.
2. Server-side secrets — Every API key and token in environment variables, never in client code or the repo.
3. Input validation — Every form and endpoint guarded against injection and malformed data (OWASP A03).
4. Access control — Row-level rules so users can only read their own data (OWASP A01 — the Lovable incident class).
5. Rate limiting — So one user or bot can’t hammer your app or your AI bill.
6. Secure data layer — Real schema, least-privilege DB access, and automated backups.
7. HTTPS & security headers — TLS, correct CORS, and headers (CSP, HSTS) set properly.
8. Error handling & logging — Graceful failures, no secrets in error messages, alerts when something breaks.
9. Dependency & AI-output review — Check generated code and packages for known-vulnerable patterns.
10. Tested under load & attack — Confirm the critical paths hold before real users arrive.

Fail 3 or more? Don’t launch yet. Get the $500 audit for a scored report, or read why AI code is so often vulnerable.