Built Your Website with AI? 7 Things to Check Before You Launch

Built your website or app with Lovable, Bolt, Base44 or another AI tool? That’s a fast way to get something working. But before you launch, it’s worth checking whether you need to fix your vibe coded website first, because AI-built website problems are usually invisible until a customer, a search engine or an attacker finds them.

The good news is that most problems are quick to spot and fix. In this guide, I’ll walk you through seven checks, from exposed passwords and open databases to phones, speed and Google.

I’m Jay, a freelance web developer based in Melbourne. I check, clean up and fix AI-built websites for businesses here and around the world, and these are the checks I run first.

Why you might need to fix a vibe coded website#

AI tools are very good at making a site look finished. However, they’re less reliable at the parts you can’t see. So, what usually breaks in AI-built websites?

• Security settings, such as databases anyone can read, or passwords and keys left in the code.
• Logins and permissions, where people can see or change things they shouldn’t.
• Forms, which may accept anything, attract spam, or send enquiries nowhere.
• Phones and speed, because the site was only checked on one screen.
• Google visibility, because nobody set up titles, a sitemap or Search Console.
• Ownership, because the domain, code or data sits in someone else’s account.

These aren’t just theory. In 2025, a researcher reported that many apps built with Lovable had databases outsiders could read and even change without logging in, because access rules were missing. It was rated critical (CVE-2025-48757), though Lovable disputes it, saying each customer is responsible for protecting their own app’s data. That same year, Wiz researchers found a flaw in the Base44 platform that let people sign up to private apps they shouldn’t have accessed. Base44 fixed it within 24 hours.

In other words, the tools are improving, but checking your own app is still your job.

Vibe coded app security: 7 things to check before you launch#

1. Are your API keys or passwords visible in the code?#

Anything your website sends to the browser can be read by anyone. So, if a secret key ends up in that code, it’s public.

• How to check: View page source often doesn’t show everything, because much of the code sits in separate JavaScript files. Instead, open your site in Chrome, press F12, open the Sources tab, then press Ctrl+Shift+F (Cmd+Option+F on a Mac) to search every file. Search for words like “key”, “secret” and “token”.
• What’s OK: Supabase’s anon (or publishable) key is designed to be public, but only when row level security is switched on (see check 2).
• What’s never OK: a Supabase service role or secret key, or secret keys for services like Stripe or OpenAI. Supabase says plainly: never expose your service role or secret keys on the frontend, because they bypass your security rules.
• How to fix: move secret keys to server-side storage, such as Lovable’s Secrets or a Supabase Edge Function. Then replace any key that was exposed with a new one, because the old one may already have been copied.

2. Is your Supabase database open to the public?#

Many AI builders use Supabase for their database. Supabase row level security (RLS) is what stops one visitor from reading or changing everyone else’s data.

• How to check: in your Supabase dashboard, look at each table and make sure RLS is switched on, then check its rules. Better still, try loading data while logged out.
• How to fix: turn on RLS for every table and add rules that match who should see what. For example, “customers can only see their own orders”.

Using Lovable’s built-in backend (Lovable Cloud) instead of your own Supabase project? Then you won’t have a separate Supabase dashboard. Instead, open the More menu in your Lovable project and choose Database to see your tables, and run Lovable’s security scan to check the access rules.

On Lovable security specifically, there’s now built-in help. Its automatic scan (called the Quick scan in Lovable’s docs at the time of writing) checks database rules when you open the publish dialog, and its Deep scan also looks for leaked secrets, unprotected endpoints and unsafe input. Lovable is clear, though, that these scans can’t guarantee complete security, and that you’re responsible for your app’s security.

3. Can people see or change things they shouldn’t?#

Hiding a button isn’t the same as protecting a page. If an admin page is only hidden in the menu, someone can still type its address.

• How to check: test your site logged out, as a normal user and as an admin. Try opening admin addresses directly, and try viewing another user’s records.
• How to fix: check permissions on the server or database, not just in the design. One of the best-known Base44 app problems shows why: in 2025, the gap was in access controls behind the scenes, not on the screen.

4. Do your forms check what people type in?#

Forms are where websites meet the outside world, so they need checking more than most.

• How to check: try sending empty fields, very long text and an obviously wrong email address. Then check that real enquiries actually arrive in your inbox, not your spam folder.
• How to fix: check what people type on the server as well as in the browser, add spam protection, and only collect the personal details you actually need.

5. Will your site work well on phones and load fast?#

AI-built sites are often designed and tested on one large screen.

• How to check: open every main page on a real phone. Then run a speed test and look at the mobile score.
• How to fix: shrink large images, remove unused features and test again. My guide to why your website is slow covers the most common fixes.

6. Can Google find it?#

A site Google can’t read won’t bring you customers, however good it looks. Check that it’s public, has a sitemap and unique page titles, and is set up in Google Search Console. My guide to why a Lovable website isn’t showing on Google walks through every step.

7. Do you own it, and is it backed up?#

Finally, make sure the important things are in your hands:

• Your domain name is registered in your name, not a freelancer’s or the builder’s.
• Your code is exported to your own GitHub account.
• Your database has backups you know how to restore.
• If you collect personal details, you have a privacy policy that explains what you collect and why.

Should you fix or rebuild your AI-built site?#

Most AI-built sites don’t need starting again. A focused vibe coding cleanup is usually enough when:

• the problems are settings, such as database rules, keys, titles or a sitemap
• the site is mostly pages of information, with a simple contact form
• you’re happy with how it looks and works

A rebuild is often the better choice when:

• the app handles payments, health details or other sensitive data, and security problems run through the whole codebase
• every fix breaks something else
• the site needs to grow well beyond what was first built

If you’re unsure, start with the seven checks above. The number and type of problems they turn up will usually make the answer clear.

Want someone to check your AI-built site?#

If you’d like a second pair of eyes before launch, I fix AI-built websites for Melbourne businesses and clients around the world. I’ll run these seven checks on your site, tell you what I find, and fix what needs fixing, whether that’s a quick cleanup or a proper rebuild.

Message me on Fiverr with your website address and the AI builder you used. Messages, orders and payments are all handled securely on Fiverr.

I’m a freelance web developer in Melbourne with 8+ years of experience building fast, secure, SEO-friendly websites and web apps.

Common questions#

What usually breaks in AI-built websites?#

The parts you can’t see: database security rules, secret keys left in the code, logins and permissions, form handling, and the setup Google needs. The design is usually the part that works best.

Are my API keys or passwords visible in the code?#

They might be. Anything sent to the browser is public, so search all of your site’s code for words like “key” and “secret”. In Chrome, press F12, open the Sources tab, then press Ctrl+Shift+F (Cmd+Option+F on a Mac). A Supabase anon key is meant to be public when row level security is on, but secret keys never should be.

Is my Supabase database open to the public?#

It may be. If row level security (RLS) is switched off on a table, anyone with your public key can usually read it. Check every table in your Supabase dashboard, turn RLS on, and add rules for who can see and change what.

Do my forms check what people type in?#

Test them with empty fields, long text and a wrong email address. Good forms check what people type on the server, block spam and deliver every real enquiry to your inbox.

Will my site work well on phones and load fast?#

Open every main page on a real phone, then run a speed test and look at the mobile score. Large images and unused features are the most common causes of slow AI-built sites.

Should I fix or rebuild my vibe coded app?#

Fix it if the problems are mostly settings and the site is fairly simple. Consider a rebuild if it handles payments or sensitive data and the problems run through the whole codebase.

Sources#

• Securing your data, Supabase Docs
• Security, Lovable Documentation, checked October 2026
• CVE-2025-48757, published May 2025 (disputed by Lovable)
• Critical authentication flaw identified in Base44 vibe coding platform, Infosecurity Magazine, July 2025