What Vibe Coding to Production Actually Requires — A Checklist

This checklist is tool-agnostic. It applies whether you built your app with Cursor, Claude, v0, Bolt, Windsurf, or any other AI coding tool. It does not require ZipLoom. The goal is to give you a concrete list of things to verify before real users see your application.

The list is not exhaustive. It covers the failure modes that appear most frequently in public incidents and community post-mortems. A production app serving millions of users needs more than this. An indie project launching to its first 1,000 users needs at least this.

Security

1. 1Row-Level Security is enabled on every Postgres table that stores user data. This is a database-level setting, not an application-level one. Your AI coding tool almost certainly did not enable it.
2. 2RLS policies are defined for SELECT, INSERT, UPDATE, and DELETE on each table. Enabling RLS without policies denies all access by default.
3. 3No secrets in your code. No API keys, database URLs, or passwords in your source files. Use environment variables. Run `git log -p | grep -i 'key\|secret\|password\|token'` to check your entire commit history.
4. 4Your `.env` file is in `.gitignore`. Check this explicitly — it is a common omission in AI-generated `.gitignore` files.
5. 5Database credentials use minimum-privilege roles. Your application should not connect to Postgres as the superuser.
6. 6Authentication is required before any data access. Test that `curl https://your-app.com/api/data` returns 401, not data.
7. 7If you are using Supabase's service role key in your frontend code, stop. The service role key bypasses RLS and should only be used in server-side code.
8. 8CORS is configured to your domain, not `*`, in your API or edge function configuration.

Secrets and environment variables

1. 1Every secret is stored as an environment variable on your hosting platform, not in your codebase.
2. 2Your production environment uses a different database from your development environment.
3. 3Your production Stripe key is in live mode (`sk_live_...`), not test mode (`sk_test_...`).
4. 4Your email provider credentials are for a sending domain you control — not a personal email address.
5. 5You have rotated any API keys that were ever committed to git, even briefly, even in a private repository.

Authentication

1. 1Password reset works. Send yourself a password reset email and complete the flow.
2. 2Email verification works if you have it enabled.
3. 3Session expiry is configured. Decide whether you want sessions to expire and set the appropriate timeout.
4. 4Protected routes actually redirect unauthenticated users. Click through your protected pages while logged out.
5. 5You have tested the sign-up flow with a real email address you control, not a test account.

Data

1. 1You have a database backup configured. Supabase includes automated daily backups on paid plans. If you are on a free plan, set up a scheduled export.
2. 2You know how to restore from a backup. Test this before you need it.
3. 3Your migrations are tracked and versioned. If you use Drizzle or Prisma, your migration history is in your git repository.
4. 4You have not run `DROP TABLE` or `DELETE FROM` commands directly in the production database without a backup.

Performance

1. 1Database queries that filter by user_id have an index on user_id. AI-generated schemas frequently omit indexes.
2. 2You have tested your application's load time on a real device, not your development machine.
3. 3Images are compressed and served in modern formats (WebP, AVIF). AI coding tools often generate `<img src='large-png.png'>` without optimization.
4. 4Your application does not make N+1 database queries. Load a page with multiple records and count the database queries in your Supabase logs.

Legal

1. 1You have a Privacy Policy that accurately describes what data you collect and how you use it. If you collect email addresses, you need one.
2. 2You have Terms of Service if your application is commercial.
3. 3If you are in the EU or serving EU users, you have a Cookie Policy and consent mechanism for analytics.
4. 4Your Stripe integration correctly handles failed payments and sends the appropriate notifications to customers.