AI 生成應用程式上線前的 4 項檢查
The 4 things I check before launching an AI-built app
作者列出 AI 編碼工具生成的應用程式上線前要檢查的四項安全事項：已暴露的密鑰與機密資料、資料庫權限、API 授權檢查，以及付款處理。機密資料如曾提交至版本庫，應視為已外洩並輪換；伺服器須核實用戶對資料的存取權限，付款成功則應以付款服務商的 webhook 確認。
AI coding tools get you to a working app fast. They are less good at the unglamorous parts that decide whether it is safe to put in front of real users. Before I launch anything built with Cursor, Lovable, Claude or ChatGPT, I check the same four things.
1. Exposed keys and secrets
API keys have a habit of ending up in the repo: pasted into a config file to "just get it working", committed, and forgotten. Search the whole repo, including old commits, for anything that looks like a key, token or connection string. If a secret has ever been committed, treat it as leaked and rotate it. Deleting the line is not enough, because it stays in the history.
2. Open databases
A database that works in development is often wide open: no row-level rules, public read access, or a default admin account. Check who can read and write each table or collection when you are not logged in at all. If the answer is "anyone", fix it before launch.
3. Missing auth checks
It is easy for the page to hide a button while the API behind it still answers anyone. For every endpoint that changes or returns user data, confirm the server checks who is asking, and that they are allowed to see that record, not just that they are logged in.
4. Payment bugs
Check that prices and amounts are decided on the server, not trusted from the browser. Confirm that a payment is only treated as successful when your payment provider's webhook says so, and that a failed or repeated webhook cannot give someone free access or charge them twice.
Doing it faster
You can do all of this by hand, and it is worth doing once so you know what you are looking for. Reading a whole repo for it every time gets tedious, so I built a tool for it: Quick Scan First. It scans a GitHub repository for exposed keys, open databases, missing auth checks and payment bugs, then opens a pull request with a proposed fix. You review the pull request and approve every change. It does not store your code. There are 3 free scans and 2 free fixes, and Pro is from £10 a month plus VAT.
Disclosure: I made Quick Scan First. The checklist above works with or without it.
來源：DEV Community · dev.to