From Prototype to Production: A Layered Checklist for Apps Built with Lovable, Bolt and v0

“It works” is the standard a prototype has to meet. Production adds a harder one: it keeps working for strangers, under load, when something fails, and when you are not looking. AI builders get you to the first standard quickly, which is exactly why teams skip the second.
The fix is a layered review. Instead of one vague “make it secure” pass, work through the layers in order, because failures in lower layers (data, auth) make higher layers (UX, SEO) irrelevant.

Layer 1: Data access and authorization
Verify that every table, view, function and storage bucket enforces who can see what. Test with two accounts and an anonymous visitor. This is the layer where the most damaging bugs live.

Layer 2: Authentication and sessions
Check password reset flows, email verification, session expiry, OAuth redirect URLs and what happens when a user is deleted. Confirm that sensitive routes are protected on the server, not just hidden in the UI.

Layer 3: Secrets and configuration
Separate public and private keys, use different credentials for staging and production, and confirm that nothing sensitive is in the client bundle or the repository history.

Layer 4: Input validation and payments
Validate on the server. If money is involved, compute totals server-side, verify webhook signatures, and make payment handlers idempotent so a retried webhook cannot grant access twice.

Layer 5: Dependencies
AI tools sometimes pull in outdated, abandoned or unnecessary packages, and in rare cases suggest package names that do not exist or are typosquatted. Review the lockfile, remove what you do not use, and run an audit tool such as npm audit.

Layer 6: Database performance and integrity
Prototype data is tiny; production data is not. Look for missing indexes on columns used in filters and joins, queries that run inside loops (the N+1 pattern), unbounded list endpoints without pagination, and missing foreign keys or constraints that let bad data in.

Layer 7: Errors, logging and monitoring
If you do not know it broke, you cannot fix it. Add error tracking, structured logs, uptime checks and alerts that reach a person. Replace silent catch blocks with handling that reports the failure and shows users something useful.

Layer 8: Deployment and environments
Confirm that the app behaves the same on your host (Vercel, Cloudflare, Railway or Fly.io) as it did in the builder preview. Check environment variables, build settings, caching, and that migrations run in a controlled order. Enable backups and actually test a restore.

Layer 9: Reliability under real conditions
Try slow networks, double clicks, expired sessions, empty states and large inputs. Load-test the two or three endpoints that matter most, not the whole app.

Layer 10: Discoverability and accessibility
Single-page apps generated by AI tools often ship weak metadata, no sitemap and poor semantic markup. Fix titles, descriptions, canonical tags, heading structure, alt text and keyboard navigation. These are the last layer, not the first, but they decide whether anyone finds and can use the product.

How to use the checklist
Work top to bottom, record each finding with a severity, and fix by severity rather than by how easy the fix is. Re-run the layers after any large AI-generated change, since regeneration can quietly undo earlier fixes.

A team that has built many such apps will tell you the same thing: the issues are rarely exotic. They are ordinary gaps that no one was assigned to look for. For a longer version of this process, see Fixier’s 13-layer production check and vibe coded app audit guide.

Aakshar works at Fixier, a team that audits, fixes and supports apps built with Lovable, Bolt, v0 and Cursor. Learn more at fixier.co.