Guides / Pre-launch checklist: Cursor, v0, Replit

Pre-launch checklist for Cursor, v0 and Replit apps

Updated November 3, 2026

Cursor, v0 and Replit get you to a working app quickly, but each leaves a few production details to you. This checklist covers the items that most often get missed.

Environment variables and secrets

• v0 / Next.js: only variables prefixed NEXT_PUBLIC_ reach the browser. Make sure no secret uses that prefix, and set production values in your Vercel project settings.
• Replit: store keys in Replit Secrets, not in code files. Check that published apps read from Secrets.
• Cursor: make sure .env is in .gitignore, and that the AI didn't hard-code a key into a component while "fixing" an error.
• Search your deployed site's JavaScript for secret prefixes (see how to check for exposed keys).

Auth and data

• Every API route that reads or changes user data checks who's logged in, on the server.
• Admin features are protected server-side, not just hidden in the UI.
• If you use Supabase, RLS is on with real policies (RLS checklist). If you use Firebase, security rules aren't left in test mode.
• Test with two accounts: one user should never see another's data.

Exposed files and errors

• /.env, /.git/config and source maps aren't served from your production domain.
• Error pages don't show stack traces or environment details to visitors.
• Debug or test routes the AI created are removed or protected.

Security headers and HTTPS

• HTTPS only, with HTTP redirecting to HTTPS.
• Add Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options and frame protection. On Vercel these go in vercel.json or next.config; on other hosts, in their config.

SEO and share previews

• Real title and meta description on each page, not the template's.
• Open Graph and Twitter tags with a 1200×630 share image.
• robots.txt, sitemap.xml and canonical URLs pointing to your custom domain.
• Your preview or .replit.app / .vercel.app URL isn't the one you share.

Mobile, speed and accessibility

• Test on a real phone: no sideways scrolling, readable text, tappable buttons.
• Run Lighthouse in mobile mode and fix oversized images and heavy scripts.
• Images have alt text, inputs have labels, contrast is readable.

Last checks

• Click every link; fix 404s.
• Test sign-up, login, password reset and checkout end to end in a private window.
• Add a privacy policy and terms if you collect data or take payments.
• Set up a way to hear about errors, like your host's logs or an error tracker.

More guides: Is my Lovable app secure? · Bolt.new app launch checklist · Supabase RLS checklist · Exposed API keys: how to check