How to check your AI-built app for exposed API keys and secrets

Short answer: paste the prompt below into your AI coding tool (Cursor, Claude Code, Replit, Lovable, Bolt or ChatGPT), fill in the [PLACEHOLDERS], and send. SI's tip: no stress, getting stuck is totally normal. You've got this. This is prompt "19. Safety Check Before Going Live" from the Hey SI Starter Pack.

When to use it: Before you share your app with anyone, and again after adding login, a database, payments, or anything involving other people's data. AI tools sometimes leave secret keys in code or leave data open to anyone. This prompt checks for the common mistakes.

The prompt

Before I put my app online, do a beginner-level safety check. Don't change anything yet, just report.

My app uses: [e.g. "Next.js, Supabase database + auth, deployed on Vercel"]
It handles: [e.g. "users' email addresses and their plant lists" / "no personal data"]

Check and report on each of these, as ✅ OK / ⚠️ Needs fixing / ❓ Not sure:
1. Secret keys: are any API keys, passwords, or tokens written directly in the code, or committed to Git history? Is .env in .gitignore?
2. Browser-visible keys: which keys are sent to the browser? Are any of them secret keys that shouldn't be?
3. Data access: can a logged-out person, or a different user, read or change data they shouldn't? (Check database rules like row-level security, not just the screens.)
4. Forms and inputs: does the app check what people type in before saving it?
5. Error messages: do any errors show private details to users?
6. Packages: are there known vulnerable packages (run npm audit and summarize in plain words)?
7. Anything else that worries you for an app like this.

Then list the fixes in order of importance, and we'll do them one at a time.

Example (filled in)

My app uses: Next.js, Supabase database + auth, deployed on Vercel It handles: users' email addresses and their plant lists

Tips

• If a secret key was ever committed to Git or pasted somewhere public, assume it's leaked. Create a new key in the service's dashboard (often called "rotate" or "regenerate") and delete the old one. Removing it from the code is not enough.
• This is a beginner check, not a professional security audit. If your app handles payments, health info, or lots of personal data, get an experienced developer to review it.
• Fix ⚠️ items one at a time using Prompt 09's "small and safe" style, and save after each.

New here? Start with how to vibe code your first app and set up an AGENTS.md rules file.