Ownership and delivery

Prove that the app can move through a normal engineering workflow.

The current source is in a repository I control. Critical I can clone it outside the builder and reproduce a clean install and build. The production build runs in CI. Type checks, tests, and the same build used for release run without the visual editor. The full system boundary is documented. Authentication, databases, storage, functions, jobs, webhooks, APIs, email, payments, and AI providers have owners. Project and production access are intentional. Editor, repository, deployment, DNS, and live-site permissions follow least privilege and use multi-factor authentication.

Data and security

Test the controls that matter after a user gets past the interface.

Object-level authorization has been tested with separate users. Critical User A cannot read or change User B’s records by altering an ID, URL, request, or API call. Database and storage policies deny access by default. Critical Every exposed table and bucket has reviewed policies for anonymous, signed-in, and administrative roles. Private credentials stay on the server. Critical Repository history and browser bundles are clear of service-role keys, payment secrets, webhook secrets, and private API keys. Data collection and retention match the product need. Personal data, logs, analytics, subprocessors, deletion, and retention are understood for the users and markets served.

Release and recovery

Prepare for failures that a successful demo does not exercise.

Critical user paths and failure states are repeatably tested. Authentication, payments, invitations, retries, duplicate webhooks, expired sessions, loading, and error states are covered where relevant. Production failures reach a named owner. Application errors and important integration failures create useful alerts without leaking secrets or unnecessary personal data. Backups include the right data and a restore has been tested. Critical The team knows what is excluded from a backup and has rehearsed recovery with non-production data. The release and database rollback plan is written down. Critical A known commit or snapshot can be restored, and database migrations have a safe forward or backward recovery path.

Preparation score

Production review

0% 0 of 12 controls

Prototype stage

Start with code ownership and the critical controls before planning a production launch.

Missing critical controls

6 critical controls still need evidence.

Try Lovable → Read the Lovable release guide

The Lovable link is currently a direct tracked link and earns no commission. See the disclosure.

A working AI-built app is not the end of the release.

Production review

Missing critical controls

What a high score does not prove