[{"data":1,"prerenderedAt":3633},["ShallowReactive",2],{"\u002Fblog\u002Fhire-developer-finish-vibe-coded-app-2026\u002F":3,"\u002Fblog\u002Fhire-developer-finish-vibe-coded-app-2026\u002F-related":524,"\u002Fblog\u002Fhire-developer-finish-vibe-coded-app-2026\u002F-resources":3618},{"id":4,"title":5,"author":6,"body":10,"category":427,"checker":428,"createdAt":429,"description":430,"disclosure":431,"extension":432,"faq":433,"heroActions":428,"howTo":428,"lastVerified":449,"location":450,"meta":451,"navigation":457,"ogImage":428,"path":458,"primaryKeyword":459,"readingTime":460,"related":461,"seo":466,"sources":467,"stem":513,"tags":514,"takeaways":515,"updatedAt":429,"url":522,"__hash__":523},"blog\u002Fblog\u002Fhire-developer-finish-vibe-coded-app-2026.md","Hire Someone to Finish Your Vibe-Coded App (2026)",{"name":7,"social":8},"Simon Dziak",{"twitter":9},"@SzymonDziak",{"type":11,"value":12,"toc":410},"minimark",[13,17,22,25,44,47,51,133,137,140,167,198,202,205,208,211,215,218,221,225,228,232,235,238,262,268,272,275,306,310,371,378,382,396,400],[14,15,16],"p",{},"You built most of your app with Lovable, Bolt, Cursor, Replit or v0, and now you want someone to finish it. You have four options: keep prompting the builder yourself, hire a freelancer, hire an agency, or buy a fixed-price check and fix. Your builder's partner directory is one way to find a freelancer or agency. Whichever you pick, start with a written list of what is broken, ranked by severity, before anyone prices the fix. This guide covers what each option costs, what the person you hire should check first, and 10 questions to ask before you pay anyone. I sell one of these options, so I say where that applies.",[18,19,21],"h2",{"id":20},"signs-it-is-time-to-get-help","Signs it is time to get help",[14,23,24],{},"A working demo is the easy part. These are the signs the last stretch needs help:",[26,27,28,32,35,38,41],"ul",{},[29,30,31],"li",{},"Users get sent back to the sign-in screen, or see someone else's data.",[29,33,34],{},"Stripe takes the money, but the account doesn't unlock.",[29,36,37],{},"A new feature shows an empty screen or \"permission denied\".",[29,39,40],{},"It works in the preview and fails after you publish.",[29,42,43],{},"Each fix the AI makes breaks something else, and your credits keep going.",[14,45,46],{},"If two or more of these sound familiar, it is worth pricing an outside review before spending more credits.",[18,48,50],{"id":49},"your-four-options-compared","Your four options compared",[52,53,54,73],"table",{},[55,56,57],"thead",{},[58,59,60,64,67,70],"tr",{},[61,62,63],"th",{},"Option",[61,65,66],{},"What you pay",[61,68,69],{},"Good for",[61,71,72],{},"Watch out for",[74,75,76,91,105,119],"tbody",{},[58,77,78,82,85,88],{},[79,80,81],"td",{},"Keep prompting it yourself",[79,83,84],{},"Your builder plan, from about $18 to $30 a month (see below), plus your time",[79,86,87],{},"Small fixes you can test yourself",[79,89,90],{},"Fix loops, and security problems you can't see in the preview",[58,92,93,96,99,102],{},[79,94,95],{},"Freelancer",[79,97,98],{},"Hourly or per project, set by each freelancer",[79,100,101],{},"One experienced developer on a mostly built app",[79,103,104],{},"Quality varies; scope and ownership need to be written down",[58,106,107,110,113,116],{},[79,108,109],{},"Agency",[79,111,112],{},"Hourly or per project; the Clutch listings I checked had $10,000+ minimums",[79,114,115],{},"Bigger builds that need design, several developers and project management",[79,117,118],{},"A minimum that is larger than the job",[58,120,121,124,127,130],{},[79,122,123],{},"Fixed-price check and fix",[79,125,126],{},"A set price, agreed before the work starts",[79,128,129],{},"A clear list of problems and a known total",[79,131,132],{},"Only covers the issues in scope; check what is excluded",[134,135,81],"h3",{"id":136},"keep-prompting-it-yourself",[14,138,139],{},"This is the cheapest option in cash. Paid plans, checked October 21, 2026 (Cursor is left out because I couldn't verify its pricing page):",[26,141,142,149,155,161],{},[29,143,144,148],{},[145,146,147],"strong",{},"Lovable:"," Pro starts at $25 a month for 100 credits.",[29,150,151,154],{},[145,152,153],{},"Bolt.new:"," Pro is $18 a month, billed annually.",[29,156,157,160],{},[145,158,159],{},"Replit:"," Core is $20 a month, or $18 a month billed annually.",[29,162,163,166],{},[145,164,165],{},"v0:"," Plus is $30 per user a month, before VAT.",[14,168,169,170,175,176,175,180,175,184,175,188,192,193,197],{},"The cost is time and risk. A builder can \"fix\" a bug by loosening a database rule, and the preview won't show you that other users' data is now readable. If you stay on your own, work through the checklist for your tool first: ",[171,172,174],"a",{"href":173},"\u002Fblog\u002Flovable-app-rescue-2026\u002F","Lovable",", ",[171,177,179],{"href":178},"\u002Fblog\u002Fbolt-app-rescue-2026\u002F","Bolt",[171,181,183],{"href":182},"\u002Fblog\u002Fcursor-app-rescue-2026\u002F","Cursor",[171,185,187],{"href":186},"\u002Fblog\u002Freplit-app-rescue-2026\u002F","Replit",[171,189,191],{"href":190},"\u002Fblog\u002Fv0-app-rescue-2026\u002F","v0"," or ",[171,194,196],{"href":195},"\u002Fblog\u002Fbase44-app-rescue-2026\u002F","Base44",".",[134,199,201],{"id":200},"hire-a-freelancer","Hire a freelancer",[14,203,204],{},"One good developer can be enough for a mostly built app. Rates vary widely and most marketplaces don't publish a single number. Toptal, for example, says its members set their own hourly rate, and offers a trial of up to two weeks that is billed only if you're satisfied.",[14,206,207],{},"For a reference point, the U.S. Bureau of Labor Statistics puts the median hourly wage of software developers at $65.38 nationally and $63.77 in the Miami metro area (May 2025). That is what employers pay staff. Wages leave out an employer's benefits and overhead, and a freelancer pays their own taxes and tools, so independent quotes can differ in either direction.",[14,209,210],{},"Ask for a fixed quote per item once they have read the code, or an hourly rate with a written cap.",[134,212,214],{"id":213},"hire-an-agency","Hire an agency",[14,216,217],{},"An agency brings design, several developers and a project manager. That helps on a big build and is overkill for finishing a small one. On Clutch's developer directory, for example, one listing shows $25 to $49 an hour with a $25,000+ minimum project, and two others show $150 to $199 an hour with $10,000+ and $50,000+ minimums. That's three listings, not an average.",[14,219,220],{},"If the job is \"make what I have safe and working\", ask whether the agency takes projects that size before you book a sales call.",[134,222,224],{"id":223},"use-your-builders-partner-directory","Use your builder's partner directory",[14,226,227],{},"Lovable runs a partner program with more than 500 certified experts and solution partners. You agree scope and price directly with the partner, and Lovable says it doesn't take part in scope, pricing or contracts. Vercel lists solution and technology partners, without prices, though its partner page doesn't mention v0 specifically. These directories help you find people who know the tool. You still need to check their work the same way you would check anyone else's.",[134,229,231],{"id":230},"buy-a-fixed-price-check-and-fix","Buy a fixed-price check and fix",[14,233,234],{},"This option splits the job in two. First someone reviews the app and writes down what is broken, ranked by severity. Then you get a fixed price for fixing the worst of it. You know the total before the fixing starts, and you can take the report and fix things yourself instead.",[14,236,237],{},"This is what App369 sells, so read it as one vendor's offer:",[26,239,240,250,256],{},[29,241,242,249],{},[145,243,244,248],{},[171,245,247],{"href":246},"\u002Ffixed-price\u002Fai-app-rescue\u002F","$450 Launch Check",":"," you send read-only access, and within 3 business days you get each issue ranked critical, high or later, with where it is and how it was confirmed.",[29,251,252,255],{},[145,253,254],{},"Rescue Sprint:"," $1,950, or $1,500 after the Launch Check credit. Up to 5 critical or high issues are fixed in 7 business days, as pull requests with tests in your repository.",[29,257,258,261],{},[145,259,260],{},"Scope:"," React, Next.js or Vite front ends on Supabase or Firebase, with Stripe. If your app is outside that, you hear so before you pay.",[14,263,264,265,197],{},"The full details are on the ",[171,266,267],{"href":246},"AI-built app rescue page",[18,269,271],{"id":270},"what-the-person-you-hire-should-check-first","What the person you hire should check first",[14,273,274],{},"Whoever you hire, the first job is checking who can see and change your data. That's a common weak spot in AI-built apps, and it's hard to see from the preview.",[26,276,277,283,289,300],{},[29,278,279,282],{},[145,280,281],{},"Database access rules."," In March 2025 a researcher scanned 1,645 apps from Lovable's showcase and found exposed data in 170 of them, about 10%. The scan only looked at public pages, so signed-in areas weren't checked. The issue was published as CVE-2025-48757 in late May 2025. The lesson applies to any builder on Supabase or Firebase: test the rules with a second user account.",[29,284,285,288],{},[145,286,287],{},"Generated code in general."," Veracode reported that AI-generated code introduced risky security flaws in 45% of its tests, across more than 100 models. Veracode sells security testing, so read that as one vendor's figure. It still means nobody should ship generated code without a review.",[29,290,291,294,295,299],{},[145,292,293],{},"Supabase projects."," From October 30, 2026, Supabase requires explicit grants for new tables on existing projects, or supabase-js returns \"permission denied\". Tables you already have keep working. The free ",[171,296,298],{"href":297},"\u002Ftools\u002Fsupabase-oct-30-checker\u002F","Supabase October 30 grants checker"," checks a migration in your browser.",[29,301,302,305],{},[145,303,304],{},"Secret keys, sign-in, payments and deploys."," Check that no secret key reaches the browser, and that password reset works on the live domain. Check that a Stripe payment actually unlocks the account, and that the live site matches the preview.",[18,307,309],{"id":308},"_10-questions-to-ask-before-you-hire","10 questions to ask before you hire",[311,312,313,318,324,330,335,341,347,353,359,365],"ol",{},[29,314,315],{},[145,316,317],{},"Will you review the code and give me a written list of issues before quoting the fix?",[29,319,320,323],{},[145,321,322],{},"What access do you need?"," Read-only access to the repository and the database structure is enough for a review. Don't hand over your production admin password over chat.",[29,325,326,329],{},[145,327,328],{},"Will you keep what works, or rewrite it?"," A rewrite quoted before anyone reads the code is a red flag.",[29,331,332],{},[145,333,334],{},"Is the price fixed per item, or hourly with a written cap?",[29,336,337,340],{},[145,338,339],{},"How will you test the data rules?"," Listen for \"with a second user account\", not \"the scanner was green\".",[29,342,343,346],{},[145,344,345],{},"Where will the changes land?"," They should go into your own repository, as reviewable commits or pull requests, not as a zip file at the end.",[29,348,349,352],{},[145,350,351],{},"Who owns the code once I pay?"," Get it in writing, including which of their own tools or libraries stay theirs.",[29,354,355,358],{},[145,356,357],{},"Can I keep building with my AI tool afterwards?"," Ask how the fixes will affect the builder's sync or preview.",[29,360,361,364],{},[145,362,363],{},"What is out of scope?"," Get it in writing, especially new features, design changes and app store submissions.",[29,366,367,370],{},[145,368,369],{},"What happens if a fix breaks something later?"," Ask about a short window for follow-up fixes, and what ongoing help costs.",[14,372,373,374,197],{},"For a longer list aimed at full builds, see the ",[171,375,377],{"href":376},"\u002Fblog\u002Fapp-development-vendor-evaluation-checklist-2026\u002F","app development vendor evaluation checklist",[18,379,381],{"id":380},"red-flags","Red flags",[26,383,384,387,390,393],{},[29,385,386],{},"A price for the whole job before anyone has looked at the code.",[29,388,389],{},"Asking for your live database password or Stripe secret key in a chat message.",[29,391,392],{},"\"We'll need to rebuild it in our framework\" as the first answer.",[29,394,395],{},"No written scope, no cap on hours and no repository you control.",[18,397,399],{"id":398},"where-to-start","Where to start",[14,401,402,403,406,407,409],{},"If you want to try it yourself first, run the checklist for your builder and the ",[171,404,405],{"href":297},"Supabase grants checker",". If you'd rather have it reviewed, the ",[171,408,247],{"href":246}," gives you a ranked list of problems in 3 business days, with a fixed price for fixing them. You can use the report with whoever you hire, including yourself. I work from Miami and do everything by email, so it doesn't matter where you are.",{"title":411,"searchDepth":412,"depth":412,"links":413},"",2,[414,415,423,424,425,426],{"id":20,"depth":412,"text":21},{"id":49,"depth":412,"text":50,"children":416},[417,419,420,421,422],{"id":136,"depth":418,"text":81},3,{"id":200,"depth":418,"text":201},{"id":213,"depth":418,"text":214},{"id":223,"depth":418,"text":224},{"id":230,"depth":418,"text":231},{"id":270,"depth":412,"text":271},{"id":308,"depth":412,"text":309},{"id":380,"depth":412,"text":381},{"id":398,"depth":412,"text":399},"AI & Technology",null,"2026-10-21T12:00:00.000Z","Lovable, Bolt, Cursor, Replit or v0 app mostly built? Compare freelancer, agency, builder partner and fixed price on cost and risk, plus 10 questions to ask before you hire.","App369 publishes this guide and sells a fixed-price check and fix for AI-built apps, which is one of the options below.","md",[434,437,440,443,446],{"question":435,"answer":436},"How much does it cost to hire someone to finish a vibe-coded app?","It depends on who you hire and how much is broken. Freelancers and agencies usually quote hourly or per project after looking at the code, and the three Clutch agency listings I checked showed minimums of $10,000 to $50,000. Fixed-price options exist too: App369, which publishes this guide, sells a $450 Launch Check and a $1,950 Rescue Sprint for up to 5 critical or high issues.",{"question":438,"answer":439},"Should I hire a freelancer or an agency to finish my app?","For a small app that is mostly built, one experienced developer can be enough, and an agency minimum can be larger than the job. An agency makes more sense when you need design, several developers and ongoing project management at once.",{"question":441,"answer":442},"Will a developer have to rewrite my Lovable or Bolt app?","Often not. Many AI-built apps use common stacks such as React with Supabase or Firebase, which an experienced web developer can work on. Ask for a written review first, and treat a rewrite quote made before anyone reads the code as a red flag.",{"question":444,"answer":445},"What should a developer check first in an AI-built app?","Who can read and change data, whether secret keys reach the browser, whether sign-in and password reset work on the live site, whether payments unlock the account, and whether deploys match the preview.",{"question":447,"answer":448},"Who owns the code when I hire someone to finish my app?","Put it in writing. Your agreement should say that the code and changes belong to you once you pay, that the work lands in your own repository, and which of the developer's own tools or libraries stay theirs. Ask a lawyer if the app matters to your business.","2026-10-21","Miami, FL",{"readingTimeStats":452},{"text":453,"minutes":454,"time":455,"words":456},"8 min read",7.215,432900,1443,true,"\u002Fblog\u002Fhire-developer-finish-vibe-coded-app-2026","hire developer to finish vibe coded app","9 min",[462,463,464,465],"lovable-app-rescue-2026","bolt-app-rescue-2026","cursor-app-rescue-2026","app-development-vendor-evaluation-checklist-2026",{"title":5,"description":430},[468,471,474,477,480,483,486,489,492,495,498,501,504,507,510],{"title":469,"url":470},"U.S. Bureau of Labor Statistics, OEWS May 2025, Software Developers (15-1252), national and Miami-Fort Lauderdale-West Palm Beach hourly wages (BLS public data API), fetched 2026-10-21","https:\u002F\u002Fwww.bls.gov\u002Foes\u002Fcurrent\u002Foes151252.htm",{"title":472,"url":473},"Clutch, top software developers directory (firm listings with minimum project size and hourly rate), fetched 2026-10-21","https:\u002F\u002Fclutch.co\u002Fdevelopers",{"title":475,"url":476},"Toptal, developer hourly rates, fetched 2026-10-21","https:\u002F\u002Fwww.toptal.com\u002Fdevelopers\u002Fhourly-rate",{"title":478,"url":479},"Lovable, work with a partner, fetched 2026-10-21","https:\u002F\u002Flovable.dev\u002Fwork-with-a-partner",{"title":481,"url":482},"Lovable, Partner program, fetched 2026-10-21","https:\u002F\u002Flovable.dev\u002Fpartners",{"title":484,"url":485},"Lovable partner directory, fetched 2026-10-21","https:\u002F\u002Flovable-partner-directory.lovable.app\u002F",{"title":487,"url":488},"Vercel, partners, fetched 2026-10-21","https:\u002F\u002Fvercel.com\u002Fpartners",{"title":490,"url":491},"Lovable docs, subscription plans, fetched 2026-10-21","https:\u002F\u002Fdocs.lovable.dev\u002Fintroduction\u002Fsubscription-plans",{"title":493,"url":494},"Bolt.new, pricing, fetched 2026-10-21","https:\u002F\u002Fbolt.new\u002Fpricing",{"title":496,"url":497},"Replit, pricing, fetched 2026-10-21","https:\u002F\u002Freplit.com\u002Fpricing",{"title":499,"url":500},"v0, pricing, fetched 2026-10-21","https:\u002F\u002Fv0.app\u002Fpricing",{"title":502,"url":503},"GitHub Advisory Database, CVE-2025-48757 (Lovable row-level security), fetched 2026-10-21","https:\u002F\u002Fgithub.com\u002Fadvisories?query=CVE-2025-48757",{"title":505,"url":506},"Matt Palmer, Statement on CVE-2025-48757 (1,645 Lovable showcase projects scanned, March 2025), fetched 2026-10-21","https:\u002F\u002Fmattpalmer.io\u002Fposts\u002Fstatement-on-CVE-2025-48757\u002F",{"title":508,"url":509},"Supabase changelog, tables not exposed to Data API automatically","https:\u002F\u002Fsupabase.com\u002Fchangelog\u002F45329-breaking-change-tables-not-exposed-to-data-and-graphql-api-automatically",{"title":511,"url":512},"Veracode, 2025 GenAI Code Security Report, fetched 2026-10-21","https:\u002F\u002Fwww.veracode.com\u002Fresources\u002Fanalyst-reports\u002F2025-genai-code-security-report\u002F","blog\u002Fhire-developer-finish-vibe-coded-app-2026","hire developer to finish vibe coded app, finish ai built app, vibe-coded app, hire lovable developer, fix bolt app, cursor app developer, ai app rescue, freelancer vs agency",[516,517,518,519,520,521],"You have four ways to finish an AI-built app: keep prompting it yourself, hire a freelancer, hire an agency, or buy a fixed-price check and fix. A builder's partner directory is one way to find a freelancer or agency.","Start with a written list of what is broken, ranked by severity, before anyone quotes the fix. It turns an open-ended job into a priced one.","For reference, BLS puts the median hourly wage of US software developers at $65.38 in May 2025, and $63.77 in the Miami metro area. Those are employee wages, not freelance or agency rates.","Three agency listings I checked on Clutch showed minimum projects of $10,000, $25,000 and $50,000, which can be larger than the whole job of finishing a small app.","Lovable runs a partner directory with more than 500 certified experts and solution partners. Price and scope are agreed directly with the partner.","Whoever you hire should check database access rules first: a March 2025 scan by one researcher of 1,645 Lovable showcase apps found exposed data in 170 of them, from public pages only.","https:\u002F\u002Fapp369.com\u002Fblog\u002Fhire-developer-finish-vibe-coded-app-2026\u002F","Xo0M15jRoqgIOdBH8wAWXgrDuAwnOy-3idC6ukn9T44",[525,928,1273,1658],{"id":526,"title":527,"author":528,"body":530,"category":427,"checker":854,"createdAt":855,"description":856,"disclosure":428,"extension":432,"faq":857,"heroActions":428,"howTo":428,"lastVerified":873,"location":450,"meta":874,"navigation":457,"ogImage":428,"path":879,"primaryKeyword":880,"readingTime":881,"related":882,"seo":885,"sources":886,"stem":917,"tags":918,"takeaways":919,"updatedAt":925,"url":926,"__hash__":927},"blog\u002Fblog\u002Flovable-app-rescue-2026.md","Lovable App Rescue: 7 Problems to Fix Before Launch",{"name":7,"social":529},{"twitter":9},{"type":11,"value":531,"toc":842},[532,538,541,545,553,568,574,584,588,591,596,601,605,612,626,631,635,642,655,660,664,667,672,689,693,696,699,712,717,721,724,744,747,752,756,773,777,802,806,829],[14,533,534,537],{},[145,535,536],{},"Problems with real Lovable apps often show up in the same few places: database access rules, keys in the browser, server functions that don't check the caller, and the gap between the preview and the live app."," A Lovable app is a React front end that talks to a Supabase database, either Lovable Cloud (which Lovable says uses \"Supabase's open-source foundation\") or a Supabase project you connect. The browser calls the database directly with a public key, so the database rules are what keep one user's data away from another.",[14,539,540],{},"Below are the seven problems to check before launch, how to test each one in a few minutes, and how to fix it. The facts below come from Lovable's and Supabase's own documentation and from the public security report on Lovable apps, and I re-read each source on October 20, 2026. The how-to-check and how-to-fix steps are my own advice.",[18,542,544],{"id":543},"_1-tables-anyone-can-read-or-change","1. Tables anyone can read or change",[14,546,547,548,552],{},"Lovable's Supabase guide is blunt: \"Missing RLS policies are the most common way app data gets exposed.\" A table in the public schema with row-level security (RLS) turned off, or with a policy like ",[549,550,551],"code",{},"USING (true)",", can be read, and often changed, by anyone who has your app's public key. That key ships in your site's JavaScript by design.",[14,554,555,556,562,563,567],{},"This is not a hypothetical. ",[171,557,561],{"href":558,"rel":559},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-48757",[560],"nofollow","CVE-2025-48757"," describes \"an insufficient database Row-Level Security policy in Lovable through 2025-04-15\" that, per the CVE text, allows unauthenticated attackers to read or write tables of generated sites. The entry is marked as disputed by Lovable, because each customer is responsible for protecting their own app's data. The researchers who filed it ",[171,564,566],{"href":506,"rel":565},[560],"report"," that their own March 2025 scan, which predates Lovable's current Quick and Deep scans, found 303 endpoints across 170 projects, about 10.3% of the 1,645 they analyzed, with inadequate RLS settings.",[14,569,570,573],{},[145,571,572],{},"How to check:"," open Supabase's Security Advisor and look for \"RLS disabled in public\" and \"policy exists, RLS disabled\". Then request each table with only the public key and no login. The free scan at the end of this page does that for you.",[14,575,576,579,580,583],{},[145,577,578],{},"How to fix:"," turn on RLS for every table in the public schema and write policies that tie rows to ",[549,581,582],{},"auth.uid()",". Remove any policy that lets everyone in.",[18,585,587],{"id":586},"_2-a-green-scan-with-the-wrong-policies","2. A green scan with the wrong policies",[14,589,590],{},"Lovable's Quick scan \"runs automatically every time you publish\" and checks things like tables without RLS. A table can have a policy and still let the wrong people in. The CVE researchers said in 2025 that the scanner they tested only checked that a policy existed, \"not its correctness\". Lovable's current Quick scan reviews database access rules, for example tables without per-record access control, but it is still a fixed set of checks. Lovable itself says its tools \"cannot guarantee complete security\".",[14,592,593,595],{},[145,594,572],{}," Lovable's own best-practice guide says to \"sign in as a second user and confirm you cannot see or change the first user's data.\" Do that for every screen that shows private data, and repeat it for each role your app has.",[14,597,598,600],{},[145,599,578],{}," rewrite any policy that fails the two-user test, then test reads, inserts, updates and deletes separately. A policy that blocks reads can still allow writes.",[18,602,604],{"id":603},"_3-secret-keys-in-the-browser","3. Secret keys in the browser",[14,606,607,608,611],{},"Lovable's security docs explain that it \"generates frontend code that runs in the browser, which means API keys and other secrets cannot be stored safely in client-side code.\" Supabase says the same about its secret and ",[549,609,610],{},"service_role"," keys: never put one in a browser, a shipped app or source control. Stripe secret keys, AI provider keys and admin keys belong in the same category.",[14,613,614,616,617,175,619,175,622,625],{},[145,615,572],{}," search your GitHub repository and the built JavaScript for ",[549,618,610],{},[549,620,621],{},"sb_secret_",[549,623,624],{},"sk_live"," and your providers' key prefixes.",[14,627,628,630],{},[145,629,578],{}," rotate any secret that was ever exposed, then move the call into a server function that reads the key from Lovable's Secrets. Only the publishable or anon key belongs in the browser.",[18,632,634],{"id":633},"_4-server-functions-that-dont-check-who-is-calling","4. Server functions that don't check who is calling",[14,636,637,638,641],{},"Payments, emails, AI calls and admin actions usually run in Supabase Edge Functions that Lovable writes for you. A function that uses the service key skips RLS entirely, so it has to check the caller itself. Supabase's default is ",[549,639,640],{},"verify_jwt = true",", so \"the platform validates the JWT before your handler runs\", and it warns against turning that off just to clear an error.",[14,643,644,646,647,650,651,654],{},[145,645,572],{}," call each function with no token, then with a normal user's token for an action only an admin should take. Look for ",[549,648,649],{},"verify_jwt = false"," in ",[549,652,653],{},"supabase\u002Fconfig.toml",". Lovable's Deep scan reviews this kind of access control in your code, but \"the Deep scan does not run automatically\", so run it yourself.",[14,656,657,659],{},[145,658,578],{}," keep JWT verification on for anything a user triggers, check the user's role and ownership inside the function, and verify webhook signatures for calls from Stripe or other services.",[18,661,663],{"id":662},"_5-views-and-storage-that-skip-your-rules","5. Views and storage that skip your rules",[14,665,666],{},"Locking down a table is not enough if a view or a storage bucket exposes the same data. Supabase's advisor warns that a security definer view \"runs with elevated privileges and ignores Row-Level Security\". Files in a public storage bucket can be opened by anyone with the link.",[14,668,669,671],{},[145,670,572],{}," in the Security Advisor, look for \"security definer view\" and \"auth users exposed\". In Storage, list which buckets are public.",[14,673,674,676,677,680,681,684,685,688],{},[145,675,578],{}," recreate views with ",[549,678,679],{},"security_invoker = on",", copy the user fields you need into a ",[549,682,683],{},"profiles"," table instead of exposing ",[549,686,687],{},"auth.users",", and make buckets with private files private, with storage policies.",[18,690,692],{"id":691},"_6-the-supabase-october-30-2026-change","6. The Supabase October 30, 2026 change",[14,694,695],{},"Supabase has made \"no automatic grants\" the default for new projects since May 30, 2026, and applies it to all existing projects on October 30, 2026. Once it applies to your project, a new table in the public schema fails with \"permission denied for table\" until a migration grants it. Supabase also says \"existing tables are not affected\", so a table that is open today stays open.",[14,697,698],{},"If your Lovable app uses a Supabase project you own, the change applies. Lovable's docs don't say whether Lovable Cloud follows the same default or adds grants to the migrations it writes, so after October 30, create a test table and check it from the app.",[14,700,701,703,704,706,707,711],{},[145,702,572],{}," paste your migrations into the free ",[171,705,298],{"href":297},". The ",[171,708,710],{"href":709},"\u002Fblog\u002Fsupabase-permission-denied-new-tables-october-30-2026\u002F","full guide to the change"," has the exact grant lines.",[14,713,714,716],{},[145,715,578],{}," add a grant per role in the same migration that creates each table, next to RLS and its policies.",[18,718,720],{"id":719},"_7-no-safe-path-between-the-preview-and-production","7. No safe path between the preview and production",[14,722,723],{},"Three facts from Lovable's docs catch teams out once real users arrive:",[26,725,726,732,738],{},[29,727,728,731],{},[145,729,730],{},"Reverting doesn't undo data changes."," Lovable's guide says \"reverting restores your code, not your database data\". A bad migration or a test that wrote to the live database stays in the database.",[29,733,734,737],{},[145,735,736],{},"The live site is a snapshot."," It only changes when you publish again, so the preview and the live app can drift apart.",[29,739,740,743],{},[145,741,742],{},"GitHub sync has limits."," \"Lovable only edits and syncs one branch at a time\", and \"Git sync always creates a new repository\", so you can't attach a project to an existing repository. Two people, or Lovable and a local editor, pushing to the same branch can overwrite each other's work.",[14,745,746],{},"Moving off Lovable Cloud is possible but manual, and removing Cloud \"permanently deletes your Cloud instance and cannot be undone\", so export your database and files first.",[14,748,749,751],{},[145,750,578],{}," export and test a database backup before launch, keep schema changes in migrations in the repository, agree who pushes to the synced branch, and run payments in test mode until the two-user test passes.",[18,753,755],{"id":754},"what-to-do-this-week","What to do this week",[311,757,758,761,764,767,770],{},[29,759,760],{},"Run the free leak scan below against your live site.",[29,762,763],{},"Do the two-user test on every page with private data.",[29,765,766],{},"Search your repository for secret keys and rotate anything you find.",[29,768,769],{},"Run Lovable's Deep scan and read every finding.",[29,771,772],{},"Check your newest migrations for grants before October 30.",[18,774,776],{"id":775},"after-the-fixes-can-google-and-ai-assistants-read-it","After the fixes: can Google and AI assistants read it?",[14,778,779,780,785,786,791,792,796,797,801],{},"Check one thing before you announce it: open your live page, view the page source (not the inspector), and search for a sentence from your page. If it isn't there, the text only appears after JavaScript runs. Google renders JavaScript, but ",[171,781,784],{"href":782,"rel":783},"https:\u002F\u002Fvercel.com\u002Fblog\u002Fthe-rise-of-the-ai-crawler",[560],"Vercel's December 2024 crawler study"," found that OpenAI's, Anthropic's and Perplexity's crawlers (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot and PerplexityBot) don't, so those crawlers see a page with no text, and an assistant that relies on them can't quote it. Lovable's ",[171,787,790],{"href":788,"rel":789},"https:\u002F\u002Fdocs.lovable.dev\u002Fintroduction\u002Ffaq",[560],"FAQ"," says apps created from May 13, 2026 render pages on the server, while older apps render in the browser and get pre-rendered copies served to search engines and AI crawlers. If search matters for this app, the ",[171,793,795],{"href":794},"\u002Fservice\u002Fseo-geo-aeo\u002F","SEO, GEO and AEO page"," explains what makes a site readable for Google and AI assistants, and the ",[171,798,800],{"href":799},"\u002Ffixed-price\u002Fai-search-visibility-audit\u002F","$750 AI Search Visibility Audit"," checks it for you.",[18,803,805],{"id":804},"need-a-hand","Need a hand?",[14,807,808,809,812,813,175,815,175,817,175,819,821,822,824,825,197],{},"If you'd rather have someone else check it, the ",[171,810,811],{"href":246},"AI-Built App Rescue"," starts with a $450 Launch Check. You send read-only access, and within 3 business days you get each problem ranked by severity, with where it is and how it was confirmed, plus a fixed price for the Rescue Sprint. The $450 is credited if you go ahead, and you keep the code either way. Built with something else? See the ",[171,814,179],{"href":178},[171,816,187],{"href":186},[171,818,183],{"href":182},[171,820,196],{"href":195}," and ",[171,823,191],{"href":190}," checklists. Or ",[171,826,828],{"href":827},"\u002Fcontact\u002F","send me a short description",[14,830,831,832,836,837,841],{},"On Supabase? The ",[171,833,835],{"href":834},"\u002Fblog\u002Fsupabase-security-review-before-launch-2026\u002F","Supabase security review before launch"," covers every Supabase setting to check, with an order for fixing them. Comparing who should do the work? ",[171,838,840],{"href":839},"\u002Fblog\u002Fhire-developer-finish-vibe-coded-app-2026\u002F","Hiring someone to finish a vibe-coded app"," compares freelancers, agencies, builder partners and fixed-price checks, with 10 questions to ask before you hire.",{"title":411,"searchDepth":412,"depth":412,"links":843},[844,845,846,847,848,849,850,851,852,853],{"id":543,"depth":412,"text":544},{"id":586,"depth":412,"text":587},{"id":603,"depth":412,"text":604},{"id":633,"depth":412,"text":634},{"id":662,"depth":412,"text":663},{"id":691,"depth":412,"text":692},{"id":719,"depth":412,"text":720},{"id":754,"depth":412,"text":755},{"id":775,"depth":412,"text":776},{"id":804,"depth":412,"text":805},"supabase-leak-scan","2026-10-20T09:00:00.000Z","Your Lovable app works in the preview, but real users are coming. The 7 problems to check first, from open tables to the Supabase October 30 change.",[858,861,864,867,870],{"question":859,"answer":860},"Is my Lovable app secure if the security scan passes?","Not necessarily. Lovable says its scans \"cannot guarantee complete security\", and the Quick scan that runs on publish does not review your app code. Run the Deep scan and test access yourself with two accounts and with no login.",{"question":862,"answer":863},"Why can other users see each other's data in my Lovable app?","Usually because a table has row-level security turned off, or a policy that lets everyone in, such as USING (true). The browser talks to the database with a public key, so the policies are the only thing deciding who sees which rows.",{"question":865,"answer":866},"Will the Supabase October 30, 2026 change break my Lovable app?","Existing tables keep working. Once the change applies to your project (new projects since May 30, 2026, all existing projects on October 30, 2026), new tables return \"permission denied\" until a migration grants them to the right roles. If your app uses a Supabase project you own, the change applies. Lovable's docs don't say how Lovable Cloud handles it, so test a new table after that date.",{"question":868,"answer":869},"Can I move my Lovable app off Lovable Cloud?","Yes, but it is manual. You export your data and files, connect your own Supabase project and rebuild the schema. Lovable says removing Cloud \"permanently deletes your Cloud instance and cannot be undone\", so export first.",{"question":871,"answer":872},"Do I keep my code if I hire someone to fix my Lovable app?","Yes. Lovable syncs your project to a GitHub repository you own, and a developer can work from that repository. Lovable only syncs one branch at a time, so agree on which branch Lovable edits before anyone else pushes to it.","2026-10-20",{"readingTimeStats":875},{"text":453,"minutes":876,"time":877,"words":878},7.905,474300,1581,"\u002Fblog\u002Flovable-app-rescue-2026","lovable app rescue","8 min",[883,884],"supabase-permission-denied-new-tables-october-30-2026","firebase-security-guide-2026",{"title":527,"description":856},[887,890,893,896,899,902,904,906,908,911,914],{"title":888,"url":889},"Lovable docs, Security","https:\u002F\u002Fdocs.lovable.dev\u002Ffeatures\u002Fsecurity",{"title":891,"url":892},"Lovable docs, Supabase integration","https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fsupabase",{"title":894,"url":895},"Lovable docs, Lovable Cloud","https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fcloud",{"title":897,"url":898},"Lovable docs, GitHub integration","https:\u002F\u002Fdocs.lovable.dev\u002Fintegrations\u002Fgithub",{"title":900,"url":901},"Lovable docs, Best practices","https:\u002F\u002Fdocs.lovable.dev\u002Ftips-tricks\u002Fbest-practice",{"title":903,"url":558},"NVD, CVE-2025-48757",{"title":905,"url":506},"Matt Palmer, Statement on CVE-2025-48757",{"title":907,"url":509},"Supabase changelog, tables not exposed to the Data API automatically",{"title":909,"url":910},"Supabase docs, Database advisors","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fdatabase-advisors",{"title":912,"url":913},"Supabase docs, API keys","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fapi\u002Fapi-keys",{"title":915,"url":916},"Supabase docs, Edge Functions auth","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Ffunctions\u002Fauth","blog\u002Flovable-app-rescue-2026","lovable app rescue, fix lovable app, lovable security, lovable supabase rls, lovable cloud, lovable production, ai app rescue, vibe coded app, supabase row level security",[920,921,922,923,924],"A Lovable app talks to its Supabase database straight from the browser with a public key, so row-level security (RLS) is what stops one user from reading everyone's data.","Lovable's own docs say \"Missing RLS policies are the most common way app data gets exposed,\" and that its scans \"cannot guarantee complete security.\"","The Quick scan runs every time you publish, but the Deep scan, which reviews your app code, does not run automatically.","Reverting in Lovable restores your code, not your database data, so test risky changes before real users depend on them.","Supabase now requires an explicit grant for new tables (in all existing projects from October 30, 2026), and existing tables keep theirs, so old leaks stay open.","2026-10-21T09:00:00.000Z","https:\u002F\u002Fapp369.com\u002Fblog\u002Flovable-app-rescue-2026\u002F","TXRoHM0jLnEFb2yjX-NeIrzhOJzvw5b3NTR3Jgy_2PU",{"id":929,"title":930,"author":931,"body":933,"category":427,"checker":854,"createdAt":1190,"description":1191,"disclosure":428,"extension":432,"faq":1192,"heroActions":428,"howTo":428,"lastVerified":873,"location":450,"meta":1208,"navigation":457,"ogImage":428,"path":1213,"primaryKeyword":1214,"readingTime":881,"related":1215,"seo":1216,"sources":1217,"stem":1263,"tags":1264,"takeaways":1265,"updatedAt":925,"url":1271,"__hash__":1272},"blog\u002Fblog\u002Fbolt-app-rescue-2026.md","Bolt App Rescue: 8 Problems to Fix Before Launch",{"name":7,"social":932},{"twitter":9},{"type":11,"value":934,"toc":1177},[935,945,948,952,955,960,965,983,987,990,1007,1012,1016,1023,1028,1033,1037,1040,1045,1050,1054,1057,1062,1067,1071,1074,1079,1084,1088,1091,1096,1101,1105,1112,1117,1122,1124,1141,1143,1153,1155,1171],[14,936,937,940,941,944],{},[145,938,939],{},"Problems with real Bolt apps often show up in a handful of places Bolt's own documentation already warns about: database access rules, secret keys, sign-in emails, publishing and hosting limits."," Bolt builds your app from a prompt, publishes it on Bolt's own hosting at a ",[549,942,943],{},"bolt.host"," address, and stores data in Bolt Database, which you can later claim into your own Supabase account, or in a Supabase project you choose on a paid plan. The free scan at the end of this page works for Supabase projects only.",[14,946,947],{},"Below are the eight problems to check before launch, how to test each one, and how to fix it. The facts come from Bolt's help center and Supabase's documentation, and I re-read each source on October 20, 2026. Bolt's public GitHub repository has issues turned off, so this page relies on what Bolt documents, not on complaint counts. The how-to-check and how-to-fix steps are my own advice.",[18,949,951],{"id":950},"_1-database-tables-anyone-can-read-or-change","1. Database tables anyone can read or change",[14,953,954],{},"Bolt's database security page puts it plainly: \"A table without RLS can be read and changed by anyone.\" It also warns that when you haven't asked for sign-in, \"Bolt might write policies that allow any visitor to view, add, change, and delete the data in your database.\" Row-level security (RLS) is what decides which rows each visitor can reach.",[14,956,957,959],{},[145,958,572],{}," open the database's Security tab, which Bolt says \"uses the same database checks as the Security Advisor in Supabase\", and look for warnings about policies that are always true or tables without RLS. Then test as a logged-out visitor, and as one user trying to reach another user's rows. The free scan at the end of this page works only if your app uses a Supabase project (a supabase.co address and a public key your site ships). If your app is on Bolt Database, use the Security tab and the logged-out test above instead.",[14,961,962,964],{},[145,963,578],{}," add real sign-in first, then rewrite each table's policies: read-only for public content, insert-only for forms, owner-only for private data. Turn RLS on for every table and re-run the check.",[14,966,967,970,971,175,974,821,977,979,980,982],{},[145,968,969],{},"Supabase's October 30 change."," If your Bolt app uses a Supabase project, from October 30, 2026 new tables in existing projects are no longer granted to the ",[549,972,973],{},"anon",[549,975,976],{},"authenticated",[549,978,610],{}," roles automatically, so a table added after that date returns a \"permission denied\" error until you grant it. Paste your migrations into the free ",[171,981,298],{"href":297}," to see which tables need grants.",[18,984,986],{"id":985},"_2-secret-keys-in-front-end-code","2. Secret keys in front-end code",[14,988,989],{},"A Bolt app's front end runs in each visitor's browser, so a key placed there is public. Bolt's security audit checks that private keys and passwords \"aren't stored in your project's code or sent to visitors' browsers\", and its secrets guide says: \"Never store secrets in plain text in your code.\" A leaked Supabase secret key bypasses every access rule. A leaked payment, email or AI key can be used on your bill.",[14,991,992,994,995,175,998,175,1000,1002,1003,1006],{},[145,993,572],{}," search the code for ",[549,996,997],{},"sk_",[549,999,610],{},[549,1001,621],{}," and your providers' key prefixes, including any ",[549,1004,1005],{},"VITE_"," variables, and look at the JavaScript your live site loads.",[14,1008,1009,1011],{},[145,1010,578],{}," rotate any key that ever appeared in code, store it in the database's Secrets, and call the provider from a server function instead of the browser.",[18,1013,1015],{"id":1014},"_3-sign-up-and-password-reset-links-that-break-on-the-live-site","3. Sign-up and password-reset links that break on the live site",[14,1017,1018,1019,1022],{},"Bolt's authentication guide says: \"By default, Bolt projects use ",[549,1020,1021],{},"localhost:3000"," as the Site URL. This does not work for live applications.\" Redirects also only work for addresses on the URI Allow List. And for emails to send at all, Bolt says \"you still need to add your own Resend API key\".",[14,1024,1025,1027],{},[145,1026,572],{}," on the live site, sign up with a fresh address, click the link in the email, and run Forgot password from start to finish.",[14,1029,1030,1032],{},[145,1031,578],{}," set the Site URL to your live domain, add every domain and reset page to the URI Allow List (again after you attach a custom domain), and add your email provider's key.",[18,1034,1036],{"id":1035},"_4-the-live-site-doesnt-match-the-preview","4. The live site doesn't match the preview",[14,1038,1039],{},"Bolt's publishing guide says \"changes you make to your Bolt project aren't automatically applied to your published site.\" Fixing something in the editor and seeing it work in the preview doesn't mean customers see it.",[14,1041,1042,1044],{},[145,1043,572],{}," open the live URL in a private window after every change and compare it with the preview. In the Publish menu, look for a pending update.",[14,1046,1047,1049],{},[145,1048,578],{}," publish an update after each change, then run a short checklist on the live URL: sign-up, sign-in, payment and email.",[18,1051,1053],{"id":1052},"_5-the-site-goes-offline-at-the-hosting-limit-or-wont-publish","5. The site goes offline at the hosting limit, or won't publish",[14,1055,1056],{},"On Bolt's hosting plans, \"Free plan sites stop serving content once they hit their monthly data limits,\" and if you publish several sites, \"they share the same monthly bandwidth and request allowance.\" Separately, publishing fails above a size cap: \"The maximum allowed size is 100MB.\"",[14,1058,1059,1061],{},[145,1060,572],{}," look at usage and the spending limit in your account settings before a launch, and check how much of your project's size is images and video.",[14,1063,1064,1066],{},[145,1065,578],{}," move to a paid plan with a spending limit before launch day, and move large media to external storage so the project stays well under the cap.",[18,1068,1070],{"id":1069},"_6-undo-doesnt-undo-your-data","6. Undo doesn't undo your data",[14,1072,1073],{},"Bolt's backup guide says \"Restoring to an earlier project version will not change your current Bolt or Supabase databases.\" After a bad change, the old code can end up running against newer tables. Bolt also warns that connecting a Supabase database to a project that already has a Bolt database \"will replace the connection, which may cause data loss\", and that there is \"no supported way to migrate an existing Bolt database to Supabase\" other than claiming it.",[14,1075,1076,1078],{},[145,1077,572],{}," confirm the project is on GitHub, confirm which database the live app really uses, and try exporting your tables.",[14,1080,1081,1083],{},[145,1082,578],{}," export your data and connect GitHub before launch. If you need your own Supabase account for backups and SQL access, claim the Bolt database rather than connecting a new one to a project that holds data.",[18,1085,1087],{"id":1086},"_7-files-anyone-with-the-link-can-open","7. Files anyone with the link can open",[14,1089,1090],{},"Bolt's file storage guide explains that in a public bucket, \"Anyone with the link can see these files, even if they're not signed in to your app,\" and tells you to \"Always confirm a bucket's visibility yourself.\" User uploads such as IDs, invoices and photos belong in private buckets.",[14,1092,1093,1095],{},[145,1094,572],{}," in File Storage, read whether each bucket is public or private, and open a user's file URL in a private window.",[14,1097,1098,1100],{},[145,1099,578],{}," make user-upload buckets private, add per-user storage policies, and serve files through signed links. Then test again with two accounts.",[18,1102,1104],{"id":1103},"_8-fix-loops-that-spend-your-budget","8. Fix loops that spend your budget",[14,1106,1107,1108,1111],{},"When an error won't go away, each attempt is another AI edit. Bolt's own advice is to \"Avoid clicking ",[145,1109,1110],{},"Attempt fix"," over and over, hoping for things to eventually work out.\" Repeated attempts change more code, spend tokens, and can leave the app half-fixed.",[14,1113,1114,1116],{},[145,1115,572],{}," count how many fix attempts in a row went into one error, and whether the files being edited have grown very large.",[14,1118,1119,1121],{},[145,1120,578],{}," stop, read the real error in the browser console, ask for one change at a time, split large files, or hand the code to a developer with the exact error.",[18,1123,755],{"id":754},[311,1125,1126,1129,1132,1135,1138],{},[29,1127,1128],{},"If your app runs on a Supabase project, run the free leak scan below against your live site. If it uses Bolt Database, test the live site as a logged-out visitor.",[29,1130,1131],{},"Fix the Site URL and test sign-up and password reset on the live domain.",[29,1133,1134],{},"Search the code for secret keys and rotate anything you find.",[29,1136,1137],{},"Check every storage bucket's visibility.",[29,1139,1140],{},"Export your data and connect GitHub before launch day.",[18,1142,776],{"id":775},[14,1144,779,1145,1148,1149,796,1151,801],{},[171,1146,784],{"href":782,"rel":1147},[560]," found that OpenAI's, Anthropic's and Perplexity's crawlers (GPTBot, OAI-SearchBot, ChatGPT-User, ClaudeBot and PerplexityBot) don't, so those crawlers see a page with no text, and an assistant that relies on them can't quote it. If search matters for this app, the ",[171,1150,795],{"href":794},[171,1152,800],{"href":799},[18,1154,805],{"id":804},[14,1156,808,1157,812,1159,175,1161,175,1163,175,1165,821,1167,824,1169,197],{},[171,1158,811],{"href":246},[171,1160,174],{"href":173},[171,1162,187],{"href":186},[171,1164,183],{"href":182},[171,1166,196],{"href":195},[171,1168,191],{"href":190},[171,1170,828],{"href":827},[14,1172,831,1173,836,1175,841],{},[171,1174,835],{"href":834},[171,1176,840],{"href":839},{"title":411,"searchDepth":412,"depth":412,"links":1178},[1179,1180,1181,1182,1183,1184,1185,1186,1187,1188,1189],{"id":950,"depth":412,"text":951},{"id":985,"depth":412,"text":986},{"id":1014,"depth":412,"text":1015},{"id":1035,"depth":412,"text":1036},{"id":1052,"depth":412,"text":1053},{"id":1069,"depth":412,"text":1070},{"id":1086,"depth":412,"text":1087},{"id":1103,"depth":412,"text":1104},{"id":754,"depth":412,"text":755},{"id":775,"depth":412,"text":776},{"id":804,"depth":412,"text":805},"2026-10-20T10:00:00.000Z","Your Bolt app works in the preview, but real users are coming. The 8 problems to check first, from open tables and broken sign-up links to hosting limits.",[1193,1196,1199,1202,1205],{"question":1194,"answer":1195},"Is my Bolt app secure if the security audit passes?","The audit is a good start, but Bolt itself tells you to confirm some settings by hand, such as whether each storage bucket is public. Test as a logged-out visitor and with two accounts before launch.",{"question":1197,"answer":1198},"Why do my Bolt app's sign-up emails link to localhost?","Bolt projects use localhost:3000 as the default Site URL, which does not work for live apps. Set the Site URL to your live domain and add every domain and reset page to the URI Allow List in the database authentication settings.",{"question":1200,"answer":1201},"Why does my published Bolt site still show the old version?","Publishing is a separate step. Changes in the editor are not applied to the live site until you publish an update from the Publish menu, so always test the live URL after each publish.",{"question":1203,"answer":1204},"Can I move my Bolt app to Supabase or another host?","Bolt says there is no supported way to migrate an existing Bolt database to Supabase, other than claiming the database into your own Supabase account. Bolt warns that connecting a Supabase database to a project that already has a Bolt database may cause data loss, so export first.",{"question":1206,"answer":1207},"Do I own the code Bolt writes?","Yes. Bolt says code you create with Bolt and StackBlitz is your own and can be used for commercial purposes. Connect the project to GitHub so a developer can work on it outside Bolt.",{"readingTimeStats":1209},{"text":453,"minutes":1210,"time":1211,"words":1212},7.655,459300,1531,"\u002Fblog\u002Fbolt-app-rescue-2026","bolt app rescue",[462,883],{"title":930,"description":1191},[1218,1221,1224,1227,1230,1233,1236,1239,1242,1245,1248,1251,1254,1257,1260],{"title":1219,"url":1220},"Bolt docs, Database security","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fsecurity",{"title":1222,"url":1223},"Bolt docs, Security audit","https:\u002F\u002Fsupport.bolt.new\u002Fbuilding\u002Fsecurity",{"title":1225,"url":1226},"Bolt docs, Database authentication","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fauthentication",{"title":1228,"url":1229},"Bolt docs, Send emails","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fsend-emails",{"title":1231,"url":1232},"Bolt docs, Publish","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fhosting\u002Fpublish",{"title":1234,"url":1235},"Bolt docs, Hosting plans","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fhosting\u002Fplans",{"title":1237,"url":1238},"Bolt docs, Publish issues","https:\u002F\u002Fsupport.bolt.new\u002Ftroubleshooting\u002Fpublish-issues",{"title":1240,"url":1241},"Bolt docs, Rollback and backup","https:\u002F\u002Fsupport.bolt.new\u002Fmanaging-projects\u002Frollback-backup",{"title":1243,"url":1244},"Bolt docs, Bolt Database","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase",{"title":1246,"url":1247},"Bolt docs, File storage","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Ffile-storage",{"title":1249,"url":1250},"Bolt docs, Maximizing token efficiency","https:\u002F\u002Fsupport.bolt.new\u002Fprompting\u002Fmaximizing-token-efficiency",{"title":1252,"url":1253},"Bolt docs, Database secrets","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fsecrets",{"title":1255,"url":1256},"Bolt docs, Advanced database settings","https:\u002F\u002Fsupport.bolt.new\u002Fbolt-cloud\u002Fdatabase\u002Fadvanced",{"title":1258,"url":1259},"Bolt docs, Corporate and commercial","https:\u002F\u002Fsupport.bolt.new\u002Faccount\u002Fcorporate-commercial",{"title":1261,"url":1262},"Supabase docs, Row Level Security","https:\u002F\u002Fsupabase.com\u002Fdocs\u002Fguides\u002Fdatabase\u002Fpostgres\u002Frow-level-security","blog\u002Fbolt-app-rescue-2026","bolt app rescue, fix bolt app, bolt.new security, bolt database rls, bolt cloud, bolt.new production, ai app rescue, vibe coded app, supabase row level security",[1266,1267,1268,1269,1270],"Bolt's own docs warn that \"a table without RLS can be read and changed by anyone,\" and that if you haven't asked for sign-in, Bolt may write policies that let any visitor view, add, change and delete data.","Sign-up and password-reset emails break on the live site until you change the default Site URL, which Bolt sets to localhost:3000.","Publishing is a manual step: changes in the preview \"aren't automatically applied to your published site.\"","Restoring an earlier version does not change your Bolt or Supabase database, so the old code can end up running against newer data.","Free plan sites stop serving once they hit the monthly hosting limit, and that limit is shared by every site on your account.","https:\u002F\u002Fapp369.com\u002Fblog\u002Fbolt-app-rescue-2026\u002F","3aEWmZ-ibmJwBYPJLHTtZie2qZiFmC1BkagdPBFZ_Sg",{"id":1274,"title":1275,"author":1276,"body":1278,"category":427,"checker":854,"createdAt":1582,"description":1583,"disclosure":428,"extension":432,"faq":1584,"heroActions":428,"howTo":428,"lastVerified":873,"location":450,"meta":1600,"navigation":457,"ogImage":428,"path":1606,"primaryKeyword":1607,"readingTime":460,"related":1608,"seo":1610,"sources":1611,"stem":1648,"tags":1649,"takeaways":1650,"updatedAt":925,"url":1656,"__hash__":1657},"blog\u002Fblog\u002Fcursor-app-rescue-2026.md","Cursor App Rescue: 7 Problems to Fix Before Launch",{"name":7,"social":1277},{"twitter":9},{"type":11,"value":1279,"toc":1570},[1280,1286,1289,1293,1300,1315,1330,1335,1339,1342,1351,1356,1360,1367,1370,1383,1397,1411,1415,1418,1430,1435,1439,1442,1447,1452,1456,1465,1474,1479,1483,1498,1507,1512,1514,1534,1536,1545,1547,1564],[14,1281,1282,1285],{},[145,1283,1284],{},"Cursor writes code in your own repository, so the problems that show up with real users are ordinary web app problems that are easy to miss without a review: secret keys, unprotected endpoints, open database rules, unchecked packages and settings that differ between your machine and the host."," Unlike Lovable, Bolt or Replit, Cursor doesn't host your app or pick your database. That gives you more control, and it also means no platform check runs before you launch.",[14,1287,1288],{},"Below are the seven problems to check before launch, how to test each one, and how to fix it. The facts come from Cursor's documentation and forum, the Next.js, Vercel, Supabase and Firebase docs, OWASP, NVD and one research paper, and I re-read each source on October 20, 2026. The examples use Next.js, but the checks apply to any stack. The how-to-check and how-to-fix steps are my own advice.",[18,1290,1292],{"id":1291},"_1-secret-keys-in-the-browser-or-in-git","1. Secret keys in the browser or in git",[14,1294,1295,1296,1299],{},"In Next.js, a variable whose name starts with ",[549,1297,1298],{},"NEXT_PUBLIC_"," \"will be inlined into any JavaScript sent to the browser.\" If the agent puts a secret there to make a feature work, every visitor can read it. Supabase is blunt about its secret keys: \"A secret key bypasses every Row Level Security policy you have. Never put one in a browser, a shipped application, or source control.\"",[14,1301,1302,1303,1306,1307,1310,1311,1314],{},"Cursor can also read your ",[549,1304,1305],{},".env"," file. A Cursor staff reply on its forum explains that ",[549,1308,1309],{},".env*"," is in the default ignore list, \"but that list only applies to indexing\", and Cursor's docs say the terminal and MCP tools used by the Agent \"cannot block access to code governed by ",[549,1312,1313],{},".cursorignore","\".",[14,1316,1317,1319,1320,175,1322,175,1324,1326,1327,1329],{},[145,1318,572],{}," search the code and the git history for ",[549,1321,610],{},[549,1323,621],{},[549,1325,624],{}," and your providers' key prefixes. List every ",[549,1328,1298],{}," variable and ask whether each one is safe to publish. Open the JavaScript your live site loads and search it for the same prefixes.",[14,1331,1332,1334],{},[145,1333,578],{}," rotate every key that was ever in browser code or git, move secrets to server-only code and the host's environment settings, and keep production secrets out of the project folder.",[18,1336,1338],{"id":1337},"_2-api-routes-and-server-actions-anyone-can-call","2. API routes and server actions anyone can call",[14,1340,1341],{},"Hiding a button doesn't protect the action behind it. The Next.js data security guide says a Server Action \"is reachable via a direct POST request, not just through your application's UI,\" and that \"A page-level authentication check does not extend to the Server Actions defined within it.\" OWASP calls the related flaw insecure direct object reference (IDOR): attackers \"access or modify objects by manipulating identifiers\", such as changing an ID in a request to read another user's record.",[14,1343,1344,1346,1347,1350],{},[145,1345,572],{}," for every API route and every ",[549,1348,1349],{},"'use server'"," function, confirm it checks the session and that the record belongs to that user. Call each one while logged out, then as user B with user A's IDs.",[14,1352,1353,1355],{},[145,1354,578],{}," check authentication and ownership inside each handler, or in one server-only data layer that every handler uses. Return only the fields the screen needs, and deny by default.",[18,1357,1359],{"id":1358},"_3-database-rules-left-wide-open","3. Database rules left wide open",[14,1361,1362,1363,1366],{},"If the browser talks to the database directly, the rules are the only thing standing between a stranger and your data. Supabase says: \"Enable RLS on every table in an exposed schema.\" Firebase's own example of an open rule set carries the warning \"",[145,1364,1365],{},"NEVER"," use this rule set in production; it allows anyone to overwrite your entire database,\" and says that without authentication and rules, \"anyone who guesses your project ID can steal, modify, or delete the data.\"",[14,1368,1369],{},"A quick way to make a permission error go away during development is to turn row-level security off or add a rule that lets everyone in. That shortcut is easy to forget before launch.",[14,1371,1372,1374,1375,1378,1379,1382],{},[145,1373,572],{}," on Supabase, open the Security Advisor and search your policies for ",[549,1376,1377],{},"using ( true )",". On Firebase, search your rules for ",[549,1380,1381],{},"if true"," and for test-mode dates. Then read and write as a logged-out visitor and as a second user. If your app uses Supabase from the browser, the free scan at the end of this page does the logged-out read test for you.",[14,1384,1385,1387,1388,1391,1392,1396],{},[145,1386,578],{}," turn on RLS for every exposed table with policies tied to the signed-in user, write Firebase rules that check ",[549,1389,1390],{},"request.auth",", and keep secret or admin keys on the server. The ",[171,1393,1395],{"href":1394},"\u002Fblog\u002Ffirebase-security-guide-2026\u002F","Firebase security guide"," has worked examples.",[14,1398,1399,1401,1402,175,1404,821,1406,1408,1409,982],{},[145,1400,969],{}," If your app uses Supabase, from October 30, 2026 new tables in existing projects are no longer granted to the ",[549,1403,973],{},[549,1405,976],{},[549,1407,610],{}," roles automatically, so a table the agent adds after that date returns a \"permission denied\" error until it is granted. Paste your migrations into the free ",[171,1410,298],{"href":297},[18,1412,1414],{"id":1413},"_4-packages-that-dont-exist-or-arent-what-they-seem","4. Packages that don't exist, or aren't what they seem",[14,1416,1417],{},"Code models sometimes suggest packages that were never published. A 2024 study of 16 code models found \"the average percentage of hallucinated packages is at least 5.2% for commercial models and 21.7% for open-source models.\" Those figures cover models in general, not Cursor in particular. The risk is that someone registers an invented name with harmful code, and the next install pulls it in.",[14,1419,1420,1422,1423,192,1426,1429],{},[145,1421,572],{}," read every new line in ",[549,1424,1425],{},"package.json",[549,1427,1428],{},"requirements.txt",". Confirm each package exists on its registry, has a real history and the publisher you expect. Run your package manager's audit and commit the lockfile.",[14,1431,1432,1434],{},[145,1433,578],{}," remove anything you can't account for, install only after checking the registry, and read what the Agent wants to install before you approve it, and don't rely on Cursor's approval prompts alone.",[18,1436,1438],{"id":1437},"_5-big-edits-that-look-right-and-arent","5. Big edits that look right and aren't",[14,1440,1441],{},"Cursor's own guide to reviewing agent code says \"AI-generated code can look correct but be subtly wrong,\" and \"Passing tests don't guarantee the code works correctly,\" because the tests may check the wrong behavior. It recommends small commits, each one a single logical change, so a person can review them.",[14,1443,1444,1446],{},[145,1445,572],{}," read the full diff before you accept it, then run the main user flows by hand: sign-up, sign-in, payment and anything that writes data. Look at which tests cover sign-in, payments and data changes.",[14,1448,1449,1451],{},[145,1450,578],{}," ask for one change at a time, commit small, and add tests for the money, login and data paths. Test with a second account and realistic data, not only the demo user.",[18,1453,1455],{"id":1454},"_6-works-locally-fails-on-the-host","6. Works locally, fails on the host",[14,1457,1458,1459,1461,1462,1464],{},"The ",[549,1460,1305],{}," file on your machine is not on your host. In Next.js, ",[549,1463,1298],{}," values are fixed when the app is built: \"After being built, your app will no longer respond to changes to these environment variables.\" Vercel adds that \"Any change you make to environment variables are not applied to previous deployments, they only apply to new deployments.\"",[14,1466,1467,1469,1470,1473],{},[145,1468,572],{}," list every ",[549,1471,1472],{},"process.env"," value the code reads and confirm each one is set on the host for production and for previews. Check whether any were added after the last deploy.",[14,1475,1476,1478],{},[145,1477,578],{}," set every variable on the host, redeploy, read server-only values only on the server, and add a startup check that fails loudly when a required value is missing.",[18,1480,1482],{"id":1481},"_7-an-out-of-date-editor-and-unknown-mcp-servers","7. An out-of-date editor and unknown MCP servers",[14,1484,1485,1486,1491,1492,1497],{},"The editor itself is part of the risk. NVD lists ",[171,1487,1490],{"href":1488,"rel":1489},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-54136",[560],"CVE-2025-54136",", where in Cursor \"versions 1.2.4 and below, attackers can achieve remote and persistent code execution\" by swapping an already-approved MCP configuration for a malicious command (fixed in 1.3), and ",[171,1493,1496],{"href":1494,"rel":1495},"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2025-64109",[560],"CVE-2025-64109",", where opening a cloned repository in the Cursor CLI Beta could run a malicious MCP server \"without any warning\". Cursor's security page also says \"Cursor supports workspace trust, but it's disabled by default,\" and calls its run controls \"best-effort guardrails rather than a hard security boundary.\"",[14,1499,1500,1502,1503,1506],{},[145,1501,572],{}," confirm Cursor is on the current version, open ",[549,1504,1505],{},".cursor\u002Fmcp.json"," in any repository you cloned, and list the MCP servers you have approved.",[14,1508,1509,1511],{},[145,1510,578],{}," update Cursor, remove MCP servers you don't recognize, turn on workspace trust, and open repositories you don't trust in a plain text editor first.",[18,1513,755],{"id":754},[311,1515,1516,1519,1522,1525,1528],{},[29,1517,1518],{},"Search the code, git history and live JavaScript for secret keys, and rotate anything you find.",[29,1520,1521],{},"Call every API route and server action while logged out and as a second user.",[29,1523,1524],{},"Check your database rules, or run the free leak scan below if your app uses Supabase.",[29,1526,1527],{},"Check every package added in the last month against its registry.",[29,1529,1530,1531,1533],{},"Compare the host's environment variables with your local ",[549,1532,1305],{},", then redeploy.",[18,1535,776],{"id":775},[14,1537,779,1538,1148,1541,796,1543,801],{},[171,1539,784],{"href":782,"rel":1540},[560],[171,1542,795],{"href":794},[171,1544,800],{"href":799},[18,1546,805],{"id":804},[14,1548,808,1549,1551,1552,175,1554,175,1556,175,1558,821,1560,824,1562,197],{},[171,1550,811],{"href":246}," starts with a $450 Launch Check. You send read-only access, and within 3 business days you get each problem ranked by severity, with where it is and how it was confirmed, plus a fixed price for the Rescue Sprint. The $450 is credited if you go ahead, and you keep the code either way. Built with an app builder instead? See the ",[171,1553,174],{"href":173},[171,1555,179],{"href":178},[171,1557,187],{"href":186},[171,1559,196],{"href":195},[171,1561,191],{"href":190},[171,1563,828],{"href":827},[14,1565,831,1566,836,1568,841],{},[171,1567,835],{"href":834},[171,1569,840],{"href":839},{"title":411,"searchDepth":412,"depth":412,"links":1571},[1572,1573,1574,1575,1576,1577,1578,1579,1580,1581],{"id":1291,"depth":412,"text":1292},{"id":1337,"depth":412,"text":1338},{"id":1358,"depth":412,"text":1359},{"id":1413,"depth":412,"text":1414},{"id":1437,"depth":412,"text":1438},{"id":1454,"depth":412,"text":1455},{"id":1481,"depth":412,"text":1482},{"id":754,"depth":412,"text":755},{"id":775,"depth":412,"text":776},{"id":804,"depth":412,"text":805},"2026-10-20T12:00:00.000Z","Built with Cursor and working on your machine? The 7 problems to check before real users arrive, from leaked keys and open API routes to fake packages.",[1585,1588,1591,1594,1597],{"question":1586,"answer":1587},"Is code written by Cursor safe to launch?","It can be, once a person has reviewed it. Cursor itself says AI-generated code can look correct but be subtly wrong, and that passing tests do not prove it works. Review the diff, test the main flows by hand and test access with two accounts.",{"question":1589,"answer":1590},"Can Cursor read my .env file?","It can. A Cursor staff reply on its forum says the default ignore list only applies to indexing, not to Agent tool calls, and Cursor's docs say the terminal and MCP tools cannot block access to files in .cursorignore. Keep production secrets out of the project folder.",{"question":1592,"answer":1593},"Why does my Cursor app work locally but not after deploying?","Usually because an environment variable exists in your local .env file but not on the host, or was set after the last build. In Next.js, NEXT_PUBLIC_ values are fixed at build time, and on Vercel a variable change only applies to new deployments, so redeploy after changing one.",{"question":1595,"answer":1596},"Does the free leak scan work for apps built with Cursor?","Only if the app uses Supabase from the browser. The scan checks the public Supabase key your live site ships. For Firebase, a custom backend or server-only data access, use the two-account and logged-out tests on this page instead.",{"question":1598,"answer":1599},"Do I keep my code if I hire someone to fix my Cursor app?","Yes. A Cursor project is ordinary code in your own repository, so a developer works from that repository and you keep everything.",{"readingTimeStats":1601},{"text":1602,"minutes":1603,"time":1604,"words":1605},"9 min read",8.12,487200,1624,"\u002Fblog\u002Fcursor-app-rescue-2026","cursor app rescue",[1609,884],"replit-app-rescue-2026",{"title":1275,"description":1583},[1612,1615,1618,1621,1624,1627,1630,1633,1636,1637,1638,1641,1644,1646],{"title":1613,"url":1614},"Cursor docs, Reviewing agent code","https:\u002F\u002Fcursor.com\u002Fdocs\u002Fagent\u002Freview",{"title":1616,"url":1617},"Cursor docs, Agent security","https:\u002F\u002Fcursor.com\u002Fdocs\u002Fagent\u002Fsecurity",{"title":1619,"url":1620},"Cursor docs, Ignore files","https:\u002F\u002Fcursor.com\u002Fdocs\u002Fcontext\u002Fignore-files",{"title":1622,"url":1623},"Cursor forum, Cursor reads .env files by default","https:\u002F\u002Fforum.cursor.com\u002Ft\u002Fcursor-reads-env-files-by-default\u002F152167",{"title":1625,"url":1626},"Next.js docs, Data security","https:\u002F\u002Fnextjs.org\u002Fdocs\u002Fapp\u002Fguides\u002Fdata-security",{"title":1628,"url":1629},"Next.js docs, Environment variables","https:\u002F\u002Fnextjs.org\u002Fdocs\u002Fapp\u002Fguides\u002Fenvironment-variables",{"title":1631,"url":1632},"Vercel docs, Environment variables","https:\u002F\u002Fvercel.com\u002Fdocs\u002Fenvironment-variables",{"title":1634,"url":1635},"OWASP, Insecure Direct Object Reference Prevention Cheat Sheet","https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FInsecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",{"title":1261,"url":1262},{"title":912,"url":913},{"title":1639,"url":1640},"Firebase docs, Avoid insecure rules","https:\u002F\u002Ffirebase.google.com\u002Fdocs\u002Ffirestore\u002Fsecurity\u002Finsecure-rules",{"title":1642,"url":1643},"Spracklen et al., We Have a Package for You! (arXiv 2406.10279)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2406.10279",{"title":1645,"url":1488},"NVD, CVE-2025-54136",{"title":1647,"url":1494},"NVD, CVE-2025-64109","blog\u002Fcursor-app-rescue-2026","cursor app rescue, fix cursor app, cursor ai code review, cursor security, next.js server actions security, supabase row level security, firebase security rules, ai app rescue, vibe coded app",[1651,1652,1653,1654,1655],"Cursor's own review guide warns that \"AI-generated code can look correct but be subtly wrong,\" and that \"Passing tests don't guarantee the code works correctly.\"","In Next.js, \"A page-level authentication check does not extend to the Server Actions defined within it,\" so every action and API route has to check the user itself.","Any variable starting with NEXT_PUBLIC_ \"will be inlined into any JavaScript sent to the browser,\" so a secret key there is public.","A 2024 study found at least 5.2% of packages suggested by commercial models, and 21.7% by open-source models, did not exist. Check every new dependency before you install it.","Cursor's workspace trust is \"disabled by default\", and older Cursor versions had MCP flaws that allowed code to run on your machine, so keep Cursor updated.","https:\u002F\u002Fapp369.com\u002Fblog\u002Fcursor-app-rescue-2026\u002F","w7mux3tze3bmtpmaw3QE0A6s1LkMCXrpbe2L8P8_Myg",{"id":1659,"title":1660,"author":1661,"body":1663,"category":3589,"checker":428,"createdAt":3590,"description":3591,"disclosure":428,"extension":432,"faq":428,"heroActions":428,"howTo":428,"lastVerified":873,"location":450,"meta":3592,"navigation":457,"ogImage":428,"path":3598,"primaryKeyword":428,"readingTime":3599,"related":3600,"seo":3604,"sources":3605,"stem":3614,"tags":3615,"takeaways":428,"updatedAt":1582,"url":3616,"__hash__":3617},"blog\u002Fblog\u002Fapp-development-vendor-evaluation-checklist-2026.md","App Development Vendor Evaluation Checklist (2026)",{"name":7,"social":1662},{"twitter":9},{"type":11,"value":1664,"toc":3523},[1665,1668,1671,1680,1684,1687,1690,1694,1697,1701,1704,1738,1744,1748,1751,1771,1776,1780,1783,1809,1814,1818,1821,1847,1852,1856,1859,1885,1890,1894,1897,1923,1927,1930,1956,1960,1986,1990,1993,2019,2024,2028,2031,2057,2061,2064,2068,2071,2082,2086,2097,2101,2112,2116,2127,2131,2142,2146,2149,2153,2159,2179,2183,2209,2213,2224,2228,2239,2243,2257,2261,2272,2276,2279,2283,2289,2295,2301,2305,2310,2315,2320,2324,2329,2334,2344,2348,2351,2389,2393,2396,2416,2420,2434,2438,2441,2445,2456,2460,2463,2489,2495,2499,2513,2517,2531,2535,2538,2575,2579,2582,2586,2592,2598,2602,2607,2612,2616,2621,2626,2630,2635,2640,2644,2649,2654,2658,2663,2668,2672,2677,2682,2686,2691,2703,2707,2710,2715,2747,2751,2874,2878,2951,2955,3037,3041,3114,3118,3191,3195,3300,3305,3331,3335,3338,3343,3360,3365,3383,3388,3406,3417,3421,3424,3430,3436,3442,3448,3468,3471,3475,3480,3483,3488,3491,3496,3499,3504,3512,3517],[14,1666,1667],{},"Choosing the wrong app development vendor is one of the most expensive mistakes a business can make. Switching vendors mid-project is expensive once you count lost time, duplicated work and knowledge transfer.",[14,1669,1670],{},"This guide provides a structured, comprehensive checklist with 50+ evaluation criteria organized across six categories: technical capability, portfolio quality, communication and process, pricing models, legal protections, and red flags. Use it to compare vendors objectively, score them consistently, and make a confident selection.",[14,1672,1673,1674,1679],{},"This checklist is written by ",[171,1675,1678],{"href":1676,"rel":1677},"https:\u002F\u002Fapp369.com",[560],"App369",", a development studio, so read it knowing I sit on the vendor side of the table. This checklist reflects what actually matters --- and what does not.",[18,1681,1683],{"id":1682},"why-vendor-evaluation-matters","Why Vendor Evaluation Matters",[14,1685,1686],{},"The vendor you choose will shape your product, your timeline, and your budget for the next 6 to 18 months. A strong vendor relationship accelerates your time to market, reduces risk, and produces a higher-quality product. A poor one drains resources, creates technical debt, and may leave you with an app that needs to be rebuilt from scratch.",[14,1688,1689],{},"The time you invest in evaluation pays for itself many times over. A thorough evaluation process typically takes 2-4 weeks, which is a small investment compared to a 6-12 month development engagement.",[18,1691,1693],{"id":1692},"technical-capability-assessment","Technical Capability Assessment",[14,1695,1696],{},"Technical capability is the foundation of successful delivery. Evaluate each vendor against these 10 criteria.",[134,1698,1700],{"id":1699},"_1-framework-and-language-expertise","1. Framework and Language Expertise",[14,1702,1703],{},"Does the vendor have demonstrated proficiency in the technologies required for your project? Look for:",[26,1705,1706,1726,1732],{},[29,1707,1708,1711,1712,175,1716,1720,1721,1725],{},[145,1709,1710],{},"Primary framework experience:"," If you need a cross-platform app, does the vendor specialize in Flutter, React Native, or another cross-platform framework? If you need native development, do they have Swift (iOS) and Kotlin (Android) expertise? See my comparison guides for ",[171,1713,1715],{"href":1714},"\u002Fcompare\u002Fflutter-vs-swift\u002F","Flutter vs Swift",[171,1717,1719],{"href":1718},"\u002Fcompare\u002Fflutter-vs-kotlin\u002F","Flutter vs Kotlin",", and ",[171,1722,1724],{"href":1723},"\u002Fcompare\u002Fflutter-vs-react-native\u002F","Flutter vs React Native"," to understand the trade-offs.",[29,1727,1728,1731],{},[145,1729,1730],{},"Backend technology stack:"," What server-side technologies do they use? Node.js, Python, Go, Java? The choice matters less than their depth of expertise.",[29,1733,1734,1737],{},[145,1735,1736],{},"Years of experience"," with their primary stack. Look for at least 3 years of production experience with their recommended technology.",[14,1739,1740,1743],{},[145,1741,1742],{},"How to verify:"," Ask for code samples, open-source contributions, or technical blog posts. Request a brief technical interview where your CTO or technical advisor can assess depth of knowledge.",[134,1745,1747],{"id":1746},"_2-architecture-knowledge","2. Architecture Knowledge",[14,1749,1750],{},"A vendor's architectural thinking determines whether your app will scale gracefully or collapse under growth.",[26,1752,1753,1759,1765],{},[29,1754,1755,1758],{},[145,1756,1757],{},"Microservices vs. monolith:"," Do they understand when each approach is appropriate? A vendor that always recommends microservices regardless of project size may be over-engineering.",[29,1760,1761,1764],{},[145,1762,1763],{},"Serverless experience:"," Can they leverage serverless architectures (AWS Lambda, Google Cloud Functions) to reduce infrastructure costs for event-driven workloads?",[29,1766,1767,1770],{},[145,1768,1769],{},"Event-driven architecture:"," For apps requiring real-time features, do they have experience with message queues, WebSockets, and event streaming?",[14,1772,1773,1775],{},[145,1774,1742],{}," Ask them to whiteboard a high-level architecture for your project during a technical interview. Their approach reveals more than any portfolio piece.",[134,1777,1779],{"id":1778},"_3-devops-maturity","3. DevOps Maturity",[14,1781,1782],{},"Modern app development requires robust DevOps practices. Evaluate:",[26,1784,1785,1791,1797,1803],{},[29,1786,1787,1790],{},[145,1788,1789],{},"CI\u002FCD pipelines:"," Do they use automated build, test, and deployment pipelines? What tools (GitHub Actions, GitLab CI, Bitrise, Codemagic)?",[29,1792,1793,1796],{},[145,1794,1795],{},"Automated testing:"," What is their testing strategy? Unit tests, integration tests, end-to-end tests? What is their minimum code coverage target?",[29,1798,1799,1802],{},[145,1800,1801],{},"Deployment automation:"," Can they deploy to app stores and production environments with minimal manual intervention?",[29,1804,1805,1808],{},[145,1806,1807],{},"Environment management:"," Do they maintain separate development, staging, and production environments?",[14,1810,1811,1813],{},[145,1812,1742],{}," Ask to see their CI\u002FCD pipeline configuration for a recent project (with client details removed). A vendor with mature DevOps can show you this in minutes.",[134,1815,1817],{"id":1816},"_4-security-practices","4. Security Practices",[14,1819,1820],{},"Security cannot be an afterthought. Evaluate whether security is embedded in the vendor's development process.",[26,1822,1823,1829,1835,1841],{},[29,1824,1825,1828],{},[145,1826,1827],{},"OWASP compliance:"," Are they familiar with the OWASP Mobile Top 10 and OWASP Web Top 10? Do they actively test against these vulnerability categories?",[29,1830,1831,1834],{},[145,1832,1833],{},"Penetration testing:"," Do they conduct penetration testing before launch? Do they use automated scanning tools (SAST\u002FDAST) during development?",[29,1836,1837,1840],{},[145,1838,1839],{},"Secure coding standards:"," Do they follow secure coding guidelines? How do they handle secrets management, input validation, and authentication?",[29,1842,1843,1846],{},[145,1844,1845],{},"Incident response:"," Do they have a documented process for handling security incidents?",[14,1848,1849,1851],{},[145,1850,1742],{}," Ask about their last security audit. Request their secure development policy document. A vendor that takes security seriously will have these artifacts readily available.",[134,1853,1855],{"id":1854},"_5-performance-optimization-track-record","5. Performance Optimization Track Record",[14,1857,1858],{},"Apps that load slowly lose users.",[26,1860,1861,1867,1873,1879],{},[29,1862,1863,1866],{},[145,1864,1865],{},"Load time optimization:"," Can they demonstrate measurable performance improvements on previous projects?",[29,1868,1869,1872],{},[145,1870,1871],{},"Memory management:"," Do they profile memory usage and address leaks before launch?",[29,1874,1875,1878],{},[145,1876,1877],{},"Network optimization:"," Do they implement caching strategies, image compression, and lazy loading?",[29,1880,1881,1884],{},[145,1882,1883],{},"Battery efficiency:"," For mobile apps, do they consider battery drain from background processes, GPS usage, and network requests?",[14,1886,1887,1889],{},[145,1888,1742],{}," Download and test their previous apps. Check app size, cold start time, and general responsiveness. Run a Lighthouse audit on their web projects.",[134,1891,1893],{"id":1892},"_6-api-design-and-integration-experience","6. API Design and Integration Experience",[14,1895,1896],{},"Most modern apps rely heavily on APIs. Evaluate the vendor's integration capabilities.",[26,1898,1899,1905,1911,1917],{},[29,1900,1901,1904],{},[145,1902,1903],{},"RESTful API design:"," Do they follow REST best practices (proper HTTP methods, status codes, versioning, pagination)?",[29,1906,1907,1910],{},[145,1908,1909],{},"GraphQL experience:"," If your project could benefit from GraphQL, do they have production experience with it?",[29,1912,1913,1916],{},[145,1914,1915],{},"Third-party integrations:"," Have they integrated with the specific services you need (payment processors, CRMs, ERPs, analytics platforms)?",[29,1918,1919,1922],{},[145,1920,1921],{},"API documentation:"," Do they document their APIs? Ask to see a sample API documentation from a previous project.",[134,1924,1926],{"id":1925},"_7-database-design-expertise","7. Database Design Expertise",[14,1928,1929],{},"Data architecture decisions made early in the project have lasting consequences.",[26,1931,1932,1938,1944,1950],{},[29,1933,1934,1937],{},[145,1935,1936],{},"Relational databases:"," Experience with PostgreSQL, MySQL, or similar systems for structured data",[29,1939,1940,1943],{},[145,1941,1942],{},"NoSQL databases:"," Experience with MongoDB, Firebase, DynamoDB for flexible or real-time data needs",[29,1945,1946,1949],{},[145,1947,1948],{},"Data modeling:"," Can they design normalized schemas that balance performance and maintainability?",[29,1951,1952,1955],{},[145,1953,1954],{},"Migration strategies:"," Do they plan for schema evolution and data migration as the app evolves?",[134,1957,1959],{"id":1958},"_8-cloud-platform-experience","8. Cloud Platform Experience",[26,1961,1962,1968,1974,1980],{},[29,1963,1964,1967],{},[145,1965,1966],{},"Primary cloud provider:"," AWS, Google Cloud Platform, Azure, or multi-cloud",[29,1969,1970,1973],{},[145,1971,1972],{},"Managed services:"," Do they leverage managed services (RDS, Cloud Run, App Engine) to reduce operational overhead?",[29,1975,1976,1979],{},[145,1977,1978],{},"Cost optimization:"," Do they consider cloud cost optimization in their architecture decisions?",[29,1981,1982,1985],{},[145,1983,1984],{},"Infrastructure as Code:"," Do they use Terraform, CloudFormation, or Pulumi to manage infrastructure reproducibly?",[134,1987,1989],{"id":1988},"_9-code-quality-standards","9. Code Quality Standards",[14,1991,1992],{},"Code quality directly affects long-term maintainability and the cost of future changes.",[26,1994,1995,2001,2007,2013],{},[29,1996,1997,2000],{},[145,1998,1999],{},"Linting and formatting:"," Do they enforce consistent code style with automated tools?",[29,2002,2003,2006],{},[145,2004,2005],{},"Code reviews:"," Is every piece of code reviewed by at least one other developer before merging?",[29,2008,2009,2012],{},[145,2010,2011],{},"Testing coverage:"," What is their minimum testing coverage target?",[29,2014,2015,2018],{},[145,2016,2017],{},"Documentation:"," Do they document code, architecture decisions, and setup instructions?",[14,2020,2021,2023],{},[145,2022,1742],{}," If possible, request a code review of a sample from a recent project. Code quality is immediately apparent to an experienced reviewer.",[134,2025,2027],{"id":2026},"_10-scalability-experience","10. Scalability Experience",[14,2029,2030],{},"Your app may start with 1,000 users but needs to handle 100,000 or 1,000,000 without a rewrite.",[26,2032,2033,2039,2045,2051],{},[29,2034,2035,2038],{},[145,2036,2037],{},"Scaling milestones:"," Have they built apps that successfully scaled from thousands to hundreds of thousands of users?",[29,2040,2041,2044],{},[145,2042,2043],{},"Load testing:"," Do they conduct load testing before launch to identify bottlenecks?",[29,2046,2047,2050],{},[145,2048,2049],{},"Horizontal scaling:"," Can they design systems that scale horizontally (adding more servers) rather than only vertically (bigger servers)?",[29,2052,2053,2056],{},[145,2054,2055],{},"Database scaling:"," Do they have experience with read replicas, sharding, or distributed databases?",[18,2058,2060],{"id":2059},"portfolio-and-case-study-review","Portfolio and Case Study Review",[14,2062,2063],{},"A vendor's portfolio tells you what they have actually delivered, not just what they claim they can do.",[134,2065,2067],{"id":2066},"app-complexity-assessment","App Complexity Assessment",[14,2069,2070],{},"Review 3-5 apps from the vendor's portfolio and evaluate:",[26,2072,2073,2076,2079],{},[29,2074,2075],{},"Does their portfolio include apps of similar complexity to your project?",[29,2077,2078],{},"Have they built apps with the specific features you need (real-time chat, payment processing, geolocation, AR\u002FVR)?",[29,2080,2081],{},"Do the apps in their portfolio demonstrate technical sophistication or are they primarily simple CRUD applications?",[134,2083,2085],{"id":2084},"industry-relevance","Industry Relevance",[26,2087,2088,2091,2094],{},[29,2089,2090],{},"Have they worked in your industry before? Industry experience means they understand your users, regulations, and competitive landscape.",[29,2092,2093],{},"If they lack direct industry experience, do they have experience with similar user workflows or compliance requirements?",[29,2095,2096],{},"Can they articulate specific challenges and lessons learned from projects in your domain?",[134,2098,2100],{"id":2099},"design-quality-evaluation","Design Quality Evaluation",[26,2102,2103,2106,2109],{},[29,2104,2105],{},"Are the apps in their portfolio visually polished and consistent with modern design standards?",[29,2107,2108],{},"Do the apps follow platform conventions (Material Design for Android, Human Interface Guidelines for iOS)?",[29,2110,2111],{},"Is the user experience intuitive? Download and use their apps yourself --- first impressions matter.",[134,2113,2115],{"id":2114},"app-store-ratings-of-previous-work","App Store Ratings of Previous Work",[26,2117,2118,2121,2124],{},[29,2119,2120],{},"Check the App Store and Google Play ratings for apps the vendor has built",[29,2122,2123],{},"Read recent user reviews. Look for patterns: frequent crashes, slow performance, or poor UX suggest quality issues",[29,2125,2126],{},"Note the update frequency. Regular updates indicate ongoing maintenance and a healthy client relationship",[134,2128,2130],{"id":2129},"live-demo-availability","Live Demo Availability",[26,2132,2133,2136,2139],{},[29,2134,2135],{},"Can the vendor provide a live demo or test account for apps they have built?",[29,2137,2138],{},"Are the apps still live and actively maintained, or have they been abandoned?",[29,2140,2141],{},"Ask the vendor to walk you through a case study in detail, explaining technical decisions and trade-offs",[18,2143,2145],{"id":2144},"communication-and-process-evaluation","Communication and Process Evaluation",[14,2147,2148],{},"Technical skill matters, but communication determines whether that skill translates into a successful project.",[134,2150,2152],{"id":2151},"response-time-during-evaluation","Response Time During Evaluation",[14,2154,2155,2158],{},[145,2156,2157],{},"This is one of the strongest predictors of future collaboration quality."," Track how long each vendor takes to respond during the evaluation process. If they are slow to respond when they are trying to win your business, expect worse response times after the contract is signed.",[26,2160,2161,2167,2173],{},[29,2162,2163,2166],{},[145,2164,2165],{},"Excellent:"," Same-day responses to emails, proactive updates",[29,2168,2169,2172],{},[145,2170,2171],{},"Acceptable:"," 24-hour response time during business days",[29,2174,2175,2178],{},[145,2176,2177],{},"Concerning:"," 48+ hours without acknowledgment",[134,2180,2182],{"id":2181},"project-management-methodology","Project Management Methodology",[26,2184,2185,2191,2197,2203],{},[29,2186,2187,2190],{},[145,2188,2189],{},"Agile\u002FScrum:"," Do they work in sprints? What is their sprint duration (1 or 2 weeks)?",[29,2192,2193,2196],{},[145,2194,2195],{},"Sprint ceremonies:"," Do they conduct sprint planning, daily standups, sprint reviews, and retrospectives?",[29,2198,2199,2202],{},[145,2200,2201],{},"Tools:"," What project management tools do they use (Jira, Linear, Asana, ClickUp)?",[29,2204,2205,2208],{},[145,2206,2207],{},"Backlog management:"," How do they manage and prioritize the product backlog?",[134,2210,2212],{"id":2211},"reporting-frequency-and-format","Reporting Frequency and Format",[26,2214,2215,2218,2221],{},[29,2216,2217],{},"What reports will you receive and how often? (Sprint reports, burn-down charts, time tracking)",[29,2219,2220],{},"Will you have access to the project management tool to see progress in real time?",[29,2222,2223],{},"How do they communicate blockers and risks?",[134,2225,2227],{"id":2226},"escalation-procedures","Escalation Procedures",[26,2229,2230,2233,2236],{},[29,2231,2232],{},"Who do you contact if your project manager is unresponsive?",[29,2234,2235],{},"What is the escalation path for disagreements about scope, quality, or timeline?",[29,2237,2238],{},"Do they have a formal escalation policy documented?",[134,2240,2242],{"id":2241},"time-zone-compatibility","Time Zone Compatibility",[26,2244,2245,2248,2251,2254],{},[29,2246,2247],{},"What are their working hours relative to yours?",[29,2249,2250],{},"How much overlap do you have for real-time communication?",[29,2252,2253],{},"Are they willing to accommodate meetings during your business hours?",[29,2255,2256],{},"For vendors in significantly different time zones, how do they handle urgent issues?",[134,2258,2260],{"id":2259},"language-proficiency","Language Proficiency",[26,2262,2263,2266,2269],{},[29,2264,2265],{},"Can they communicate complex technical concepts clearly in your language?",[29,2267,2268],{},"Are project managers, tech leads, and designers all proficient, or only the sales team?",[29,2270,2271],{},"Ask for a technical meeting with the actual team members who would work on your project, not just account managers",[18,2273,2275],{"id":2274},"pricing-model-analysis","Pricing Model Analysis",[14,2277,2278],{},"Understanding pricing models helps you choose the structure that best fits your project type and risk tolerance.",[134,2280,2282],{"id":2281},"fixed-price","Fixed Price",[14,2284,2285,2288],{},[145,2286,2287],{},"How it works:"," The vendor quotes a fixed total cost for a defined scope of work.",[14,2290,2291,2294],{},[145,2292,2293],{},"Best for:"," Projects with well-defined, stable requirements that are unlikely to change significantly.",[14,2296,2297,2300],{},[145,2298,2299],{},"Risks:"," Vendors pad estimates to cover unknowns. Changes to scope require formal change orders with additional costs. Quality may suffer if the vendor underestimated the work.",[134,2302,2304],{"id":2303},"time-and-materials-tm","Time and Materials (T&M)",[14,2306,2307,2309],{},[145,2308,2287],{}," You pay for actual hours worked at agreed hourly or daily rates.",[14,2311,2312,2314],{},[145,2313,2293],{}," Projects where requirements will evolve, early-stage products, or ongoing development engagements.",[14,2316,2317,2319],{},[145,2318,2299],{}," Total cost is less predictable. Without strong project management, costs can escalate. Requires trust in the vendor's efficiency.",[134,2321,2323],{"id":2322},"retainer","Retainer",[14,2325,2326,2328],{},[145,2327,2287],{}," You pay a fixed monthly fee for a dedicated team or set number of hours.",[14,2330,2331,2333],{},[145,2332,2293],{}," Long-term engagements, ongoing maintenance, or businesses that need consistent development capacity.",[14,2335,2336,2338,2339,2343],{},[145,2337,2299],{}," You pay for capacity whether or not you fully utilize it. Check my ",[171,2340,2342],{"href":2341},"\u002Ffee-structure\u002F","fee structure"," for more detail on how different pricing models compare.",[134,2345,2347],{"id":2346},"hidden-cost-identification","Hidden Cost Identification",[14,2349,2350],{},"When comparing vendor pricing, ask about these commonly overlooked costs:",[26,2352,2353,2359,2365,2371,2377,2383],{},[29,2354,2355,2358],{},[145,2356,2357],{},"Change request fees:"," How are scope changes priced?",[29,2360,2361,2364],{},[145,2362,2363],{},"Third-party licenses:"," Are costs for libraries, APIs, or tools included?",[29,2366,2367,2370],{},[145,2368,2369],{},"Hosting and infrastructure:"," Is cloud hosting included or separate?",[29,2372,2373,2376],{},[145,2374,2375],{},"App store fees:"," Apple Developer ($99\u002Fyear) and Google Play ($25 one-time) accounts",[29,2378,2379,2382],{},[145,2380,2381],{},"Testing devices:"," Who provides physical devices for testing?",[29,2384,2385,2388],{},[145,2386,2387],{},"Project management overhead:"," Is PM time billed separately or included?",[134,2390,2392],{"id":2391},"payment-milestone-structure","Payment Milestone Structure",[14,2394,2395],{},"Evaluate how the vendor structures payment milestones:",[26,2397,2398,2404,2410],{},[29,2399,2400,2403],{},[145,2401,2402],{},"Typical healthy structure:"," 20% at kickoff, 30% at design approval, 30% at development completion, 20% at launch",[29,2405,2406,2409],{},[145,2407,2408],{},"Red flag:"," More than 50% upfront before any deliverables",[29,2411,2412,2415],{},[145,2413,2414],{},"Best practice:"," Tie payments to specific deliverables, not dates",[134,2417,2419],{"id":2418},"post-launch-maintenance-pricing","Post-Launch Maintenance Pricing",[26,2421,2422,2425,2428,2431],{},[29,2423,2424],{},"What does post-launch support cost?",[29,2426,2427],{},"What does the maintenance package include? (Bug fixes, OS updates, minor enhancements, server monitoring)",[29,2429,2430],{},"What is the response time SLA for critical bugs vs. non-critical issues?",[29,2432,2433],{},"How long is the warranty period after launch? (In my experience 30 to 90 days is common, but it varies, so get the length in writing.)",[18,2435,2437],{"id":2436},"legal-and-security-checklist","Legal and Security Checklist",[14,2439,2440],{},"Legal protections are not optional. They safeguard your investment, your data, and your intellectual property.",[134,2442,2444],{"id":2443},"nda-willingness","NDA Willingness",[26,2446,2447,2450,2453],{},[29,2448,2449],{},"Will the vendor sign a Non-Disclosure Agreement before you share project details?",[29,2451,2452],{},"Do they have a standard NDA, or will they sign yours?",[29,2454,2455],{},"A vendor reluctant to sign an NDA is a vendor you should not work with",[134,2457,2459],{"id":2458},"ip-ownership-clarity","IP Ownership Clarity",[14,2461,2462],{},"This is the single most important legal consideration. Ensure your contract clearly states:",[26,2464,2465,2471,2477,2483],{},[29,2466,2467,2470],{},[145,2468,2469],{},"You own the code"," produced for your project upon payment",[29,2472,2473,2476],{},[145,2474,2475],{},"You own all design assets"," (logos, icons, illustrations, UI designs)",[29,2478,2479,2482],{},[145,2480,2481],{},"The vendor retains rights"," only to pre-existing frameworks, libraries, and tools they bring to the project",[29,2484,2485,2488],{},[145,2486,2487],{},"Work-for-hire provisions"," are clearly defined",[14,2490,2491,2494],{},[145,2492,2493],{},"Warning:"," Some vendors retain code ownership by default and license it to you. This means they could theoretically reuse your custom code for another client. Always negotiate full IP transfer.",[134,2496,2498],{"id":2497},"data-handling-policies","Data Handling Policies",[26,2500,2501,2504,2507,2510],{},[29,2502,2503],{},"How does the vendor handle your data and your users' data during development?",[29,2505,2506],{},"Do they use production data for testing, or do they generate synthetic test data?",[29,2508,2509],{},"What happens to your data if you terminate the engagement?",[29,2511,2512],{},"Where is data stored geographically? This matters for GDPR, data residency laws, and certain industry regulations.",[134,2514,2516],{"id":2515},"insurance-coverage","Insurance Coverage",[26,2518,2519,2522,2525,2528],{},[29,2520,2521],{},"Does the vendor carry professional liability (Errors & Omissions) insurance?",[29,2523,2524],{},"Do they have cyber liability insurance?",[29,2526,2527],{},"What is their coverage amount? (Many clients ask for at least $1M, but the right amount depends on the contract size and your industry.)",[29,2529,2530],{},"Can they provide a certificate of insurance upon request?",[134,2532,2534],{"id":2533},"compliance-certifications","Compliance Certifications",[14,2536,2537],{},"Depending on your industry, you may need vendors with specific compliance certifications:",[26,2539,2540,2546,2557,2563,2569],{},[29,2541,2542,2545],{},[145,2543,2544],{},"SOC 2 Type II:"," An independent auditor's report on how a vendor's controls worked over a period of time. Reports can cover different trust services criteria (security, availability, processing integrity, confidentiality, privacy), so ask which ones yours covers. Worth asking for when the vendor will handle sensitive data.",[29,2547,2548,2551,2552,2556],{},[145,2549,2550],{},"HIPAA compliance:"," Applies if your app handles Protected Health Information (PHI) for a covered entity. Ask the vendor to sign a Business Associate Agreement (BAA) and to describe its safeguards in writing. See my ",[171,2553,2555],{"href":2554},"\u002Fblog\u002Fmobile-app-development-healthcare-guide\u002F","healthcare app development guide"," for details.",[29,2558,2559,2562],{},[145,2560,2561],{},"PCI-DSS:"," Required if your app processes, stores, or transmits credit card data directly.",[29,2564,2565,2568],{},[145,2566,2567],{},"GDPR compliance:"," Required if your app serves EU users. The vendor must understand data minimization, right to erasure, and consent management.",[29,2570,2571,2574],{},[145,2572,2573],{},"ISO 27001:"," Information security management certification that demonstrates mature security practices.",[18,2576,2578],{"id":2577},"red-flags-to-watch-for","Red Flags to Watch For",[14,2580,2581],{},"These warning signs should give you serious pause during the evaluation process. Any single red flag warrants further investigation. Multiple red flags mean you should move on to the next vendor.",[134,2583,2585],{"id":2584},"no-portfolio-or-references","No Portfolio or References",[14,2587,2588,2591],{},[145,2589,2590],{},"The red flag:"," The vendor cannot show you apps they have built or provide references from past clients.",[14,2593,2594,2597],{},[145,2595,2596],{},"Why it matters:"," Every legitimate development company has a portfolio. If they claim NDAs prevent them from showing work, ask for anonymized case studies that describe the project scope, challenges, and outcomes without naming the client. If they cannot provide even that, they likely lack relevant experience.",[134,2599,2601],{"id":2600},"unrealistically-low-pricing","Unrealistically Low Pricing",[14,2603,2604,2606],{},[145,2605,2590],{}," One vendor quotes $30,000 when every other vendor quotes $80,000-$120,000.",[14,2608,2609,2611],{},[145,2610,2596],{}," There are only three explanations for a dramatically lower price: they misunderstood the scope, they plan to use inexperienced developers, or they will add costs through change orders once you are committed. In all three cases, you lose. The cheapest option almost never delivers the best value.",[134,2613,2615],{"id":2614},"guaranteed-timelines-without-discovery","Guaranteed Timelines Without Discovery",[14,2617,2618,2620],{},[145,2619,2590],{}," The vendor promises an exact delivery date during the first conversation, before conducting any discovery or requirements analysis.",[14,2622,2623,2625],{},[145,2624,2596],{}," No experienced developer can accurately estimate a project without understanding the details. A vendor that guarantees timelines without discovery is either telling you what you want to hear or has no intention of meeting that deadline.",[134,2627,2629],{"id":2628},"no-dedicated-project-manager","No Dedicated Project Manager",[14,2631,2632,2634],{},[145,2633,2590],{}," The vendor expects you to manage the project yourself, or the project manager is also a developer splitting time across multiple projects.",[14,2636,2637,2639],{},[145,2638,2596],{}," A dedicated project manager is your single point of contact, your advocate, and the person responsible for keeping the project on track. Without one, communication gaps, missed deadlines, and scope confusion are almost guaranteed.",[134,2641,2643],{"id":2642},"poor-communication-during-sales","Poor Communication During Sales",[14,2645,2646,2648],{},[145,2647,2590],{}," The vendor is slow to respond, difficult to schedule with, or provides vague answers to direct questions.",[14,2650,2651,2653],{},[145,2652,2596],{}," The sales process is when a vendor is at their most responsive and attentive. If communication is poor now, it will only get worse after the contract is signed.",[134,2655,2657],{"id":2656},"outsourcing-to-undisclosed-subcontractors","Outsourcing to Undisclosed Subcontractors",[14,2659,2660,2662],{},[145,2661,2590],{}," The vendor presents a team during the sales process but plans to subcontract the actual work to a different, undisclosed team.",[14,2664,2665,2667],{},[145,2666,2596],{}," You evaluated the vendor based on their team's capabilities. If a different team does the work, your evaluation is meaningless. Always ask: \"Will the team members you present be the ones working on my project?\" Get this commitment in writing.",[134,2669,2671],{"id":2670},"no-post-launch-plan","No Post-Launch Plan",[14,2673,2674,2676],{},[145,2675,2590],{}," The vendor's proposal ends at launch with no mention of maintenance, support, or warranty.",[14,2678,2679,2681],{},[145,2680,2596],{}," Launch is the beginning of your app's lifecycle, not the end. A vendor that does not plan for post-launch support is either planning to move on immediately or does not understand the reality of app maintenance.",[134,2683,2685],{"id":2684},"taking-over-ai-generated-code-without-an-audit","Taking Over AI-Generated Code Without an Audit",[14,2687,2688,2690],{},[145,2689,2590],{}," The vendor agrees to extend an app built with Lovable, Bolt, Cursor or another AI tool without first reviewing sign-in, data access rules, payments and deploys.",[14,2692,2693,2695,2696,2699,2700,2702],{},[145,2694,2596],{}," AI-generated code often works in a demo and fails with real users. Ask for a written audit first; an ",[171,2697,2698],{"href":246},"AI-built app rescue Launch Check"," is one fixed-price example. On Supabase, you can run the free ",[171,2701,298],{"href":297}," on your migrations yourself before the first call.",[18,2704,2706],{"id":2705},"printable-scoring-matrix","Printable Scoring Matrix",[14,2708,2709],{},"Use this scoring matrix to evaluate each vendor consistently. Score each criterion from 1-5, multiply by the weight, and sum the weighted scores for a total. Print this page using the \"Save as PDF\" button for use during your evaluation.",[14,2711,2712],{},[145,2713,2714],{},"Scoring Scale:",[26,2716,2717,2723,2729,2735,2741],{},[29,2718,2719,2722],{},[145,2720,2721],{},"1"," = Does Not Meet Requirements",[29,2724,2725,2728],{},[145,2726,2727],{},"2"," = Partially Meets Requirements",[29,2730,2731,2734],{},[145,2732,2733],{},"3"," = Meets Requirements",[29,2736,2737,2740],{},[145,2738,2739],{},"4"," = Exceeds Requirements",[29,2742,2743,2746],{},[145,2744,2745],{},"5"," = Significantly Exceeds Requirements",[134,2748,2750],{"id":2749},"technical-capability-weight-30","Technical Capability (Weight: 30%)",[52,2752,2753,2766],{},[55,2754,2755],{},[58,2756,2757,2760,2763],{},[61,2758,2759],{},"Criterion",[61,2761,2762],{},"Score (1-5)",[61,2764,2765],{},"Weighted Score",[74,2767,2768,2779,2788,2797,2806,2815,2824,2833,2842,2851,2860],{},[58,2769,2770,2773,2776],{},[79,2771,2772],{},"Framework and language expertise",[79,2774,2775],{},"___",[79,2777,2778],{},"___ x 3 = ___",[58,2780,2781,2784,2786],{},[79,2782,2783],{},"Architecture knowledge",[79,2785,2775],{},[79,2787,2778],{},[58,2789,2790,2793,2795],{},[79,2791,2792],{},"DevOps maturity",[79,2794,2775],{},[79,2796,2778],{},[58,2798,2799,2802,2804],{},[79,2800,2801],{},"Security practices",[79,2803,2775],{},[79,2805,2778],{},[58,2807,2808,2811,2813],{},[79,2809,2810],{},"Performance optimization",[79,2812,2775],{},[79,2814,2778],{},[58,2816,2817,2820,2822],{},[79,2818,2819],{},"API and integration experience",[79,2821,2775],{},[79,2823,2778],{},[58,2825,2826,2829,2831],{},[79,2827,2828],{},"Database design expertise",[79,2830,2775],{},[79,2832,2778],{},[58,2834,2835,2838,2840],{},[79,2836,2837],{},"Cloud platform experience",[79,2839,2775],{},[79,2841,2778],{},[58,2843,2844,2847,2849],{},[79,2845,2846],{},"Code quality standards",[79,2848,2775],{},[79,2850,2778],{},[58,2852,2853,2856,2858],{},[79,2854,2855],{},"Scalability experience",[79,2857,2775],{},[79,2859,2778],{},[58,2861,2862,2867,2869],{},[79,2863,2864],{},[145,2865,2866],{},"Subtotal",[79,2868],{},[79,2870,2871],{},[145,2872,2873],{},"___ \u002F 150",[134,2875,2877],{"id":2876},"portfolio-and-experience-weight-25","Portfolio and Experience (Weight: 25%)",[52,2879,2880,2890],{},[55,2881,2882],{},[58,2883,2884,2886,2888],{},[61,2885,2759],{},[61,2887,2762],{},[61,2889,2765],{},[74,2891,2892,2902,2911,2920,2929,2938],{},[58,2893,2894,2897,2899],{},[79,2895,2896],{},"App complexity match",[79,2898,2775],{},[79,2900,2901],{},"___ x 2.5 = ___",[58,2903,2904,2907,2909],{},[79,2905,2906],{},"Industry relevance",[79,2908,2775],{},[79,2910,2901],{},[58,2912,2913,2916,2918],{},[79,2914,2915],{},"Design quality",[79,2917,2775],{},[79,2919,2901],{},[58,2921,2922,2925,2927],{},[79,2923,2924],{},"App Store ratings",[79,2926,2775],{},[79,2928,2901],{},[58,2930,2931,2934,2936],{},[79,2932,2933],{},"Case study depth",[79,2935,2775],{},[79,2937,2901],{},[58,2939,2940,2944,2946],{},[79,2941,2942],{},[145,2943,2866],{},[79,2945],{},[79,2947,2948],{},[145,2949,2950],{},"___ \u002F 62.5",[134,2952,2954],{"id":2953},"communication-and-process-weight-20","Communication and Process (Weight: 20%)",[52,2956,2957,2967],{},[55,2958,2959],{},[58,2960,2961,2963,2965],{},[61,2962,2759],{},[61,2964,2762],{},[61,2966,2765],{},[74,2968,2969,2979,2988,2997,3006,3015,3024],{},[58,2970,2971,2974,2976],{},[79,2972,2973],{},"Response time",[79,2975,2775],{},[79,2977,2978],{},"___ x 2 = ___",[58,2980,2981,2984,2986],{},[79,2982,2983],{},"Project management methodology",[79,2985,2775],{},[79,2987,2978],{},[58,2989,2990,2993,2995],{},[79,2991,2992],{},"Reporting quality",[79,2994,2775],{},[79,2996,2978],{},[58,2998,2999,3002,3004],{},[79,3000,3001],{},"Time zone compatibility",[79,3003,2775],{},[79,3005,2978],{},[58,3007,3008,3011,3013],{},[79,3009,3010],{},"Language proficiency",[79,3012,2775],{},[79,3014,2978],{},[58,3016,3017,3020,3022],{},[79,3018,3019],{},"Team stability",[79,3021,2775],{},[79,3023,2978],{},[58,3025,3026,3030,3032],{},[79,3027,3028],{},[145,3029,2866],{},[79,3031],{},[79,3033,3034],{},[145,3035,3036],{},"___ \u002F 60",[134,3038,3040],{"id":3039},"pricing-weight-15","Pricing (Weight: 15%)",[52,3042,3043,3053],{},[55,3044,3045],{},[58,3046,3047,3049,3051],{},[61,3048,2759],{},[61,3050,2762],{},[61,3052,2765],{},[74,3054,3055,3065,3074,3083,3092,3101],{},[58,3056,3057,3060,3062],{},[79,3058,3059],{},"Total cost competitiveness",[79,3061,2775],{},[79,3063,3064],{},"___ x 1.5 = ___",[58,3066,3067,3070,3072],{},[79,3068,3069],{},"Pricing transparency",[79,3071,2775],{},[79,3073,3064],{},[58,3075,3076,3079,3081],{},[79,3077,3078],{},"Payment structure fairness",[79,3080,2775],{},[79,3082,3064],{},[58,3084,3085,3088,3090],{},[79,3086,3087],{},"Post-launch pricing clarity",[79,3089,2775],{},[79,3091,3064],{},[58,3093,3094,3097,3099],{},[79,3095,3096],{},"Hidden cost risk (lower = better)",[79,3098,2775],{},[79,3100,3064],{},[58,3102,3103,3107,3109],{},[79,3104,3105],{},[145,3106,2866],{},[79,3108],{},[79,3110,3111],{},[145,3112,3113],{},"___ \u002F 37.5",[134,3115,3117],{"id":3116},"legal-and-security-weight-10","Legal and Security (Weight: 10%)",[52,3119,3120,3130],{},[55,3121,3122],{},[58,3123,3124,3126,3128],{},[61,3125,2759],{},[61,3127,2762],{},[61,3129,2765],{},[74,3131,3132,3142,3151,3160,3169,3178],{},[58,3133,3134,3137,3139],{},[79,3135,3136],{},"IP ownership terms",[79,3138,2775],{},[79,3140,3141],{},"___ x 1 = ___",[58,3143,3144,3147,3149],{},[79,3145,3146],{},"NDA and confidentiality",[79,3148,2775],{},[79,3150,3141],{},[58,3152,3153,3156,3158],{},[79,3154,3155],{},"Data handling policies",[79,3157,2775],{},[79,3159,3141],{},[58,3161,3162,3165,3167],{},[79,3163,3164],{},"Insurance coverage",[79,3166,2775],{},[79,3168,3141],{},[58,3170,3171,3174,3176],{},[79,3172,3173],{},"Compliance certifications",[79,3175,2775],{},[79,3177,3141],{},[58,3179,3180,3184,3186],{},[79,3181,3182],{},[145,3183,2866],{},[79,3185],{},[79,3187,3188],{},[145,3189,3190],{},"___ \u002F 25",[134,3192,3194],{"id":3193},"overall-score","Overall Score",[52,3196,3197,3212],{},[55,3198,3199],{},[58,3200,3201,3204,3207,3209],{},[61,3202,3203],{},"Category",[61,3205,3206],{},"Weight",[61,3208,2866],{},[61,3210,3211],{},"Maximum",[74,3213,3214,3227,3240,3253,3266,3279],{},[58,3215,3216,3219,3222,3224],{},[79,3217,3218],{},"Technical Capability",[79,3220,3221],{},"30%",[79,3223,2775],{},[79,3225,3226],{},"150",[58,3228,3229,3232,3235,3237],{},[79,3230,3231],{},"Portfolio and Experience",[79,3233,3234],{},"25%",[79,3236,2775],{},[79,3238,3239],{},"62.5",[58,3241,3242,3245,3248,3250],{},[79,3243,3244],{},"Communication and Process",[79,3246,3247],{},"20%",[79,3249,2775],{},[79,3251,3252],{},"60",[58,3254,3255,3258,3261,3263],{},[79,3256,3257],{},"Pricing",[79,3259,3260],{},"15%",[79,3262,2775],{},[79,3264,3265],{},"37.5",[58,3267,3268,3271,3274,3276],{},[79,3269,3270],{},"Legal and Security",[79,3272,3273],{},"10%",[79,3275,2775],{},[79,3277,3278],{},"25",[58,3280,3281,3286,3291,3295],{},[79,3282,3283],{},[145,3284,3285],{},"TOTAL",[79,3287,3288],{},[145,3289,3290],{},"100%",[79,3292,3293],{},[145,3294,2775],{},[79,3296,3297],{},[145,3298,3299],{},"335",[14,3301,3302],{},[145,3303,3304],{},"Scoring interpretation:",[26,3306,3307,3313,3319,3325],{},[29,3308,3309,3312],{},[145,3310,3311],{},"268-335 (80-100%):"," Excellent candidate. Strong across all categories.",[29,3314,3315,3318],{},[145,3316,3317],{},"201-267 (60-79%):"," Good candidate. Review weaker areas and determine if they are deal-breakers.",[29,3320,3321,3324],{},[145,3322,3323],{},"134-200 (40-59%):"," Below average. Significant weaknesses in one or more critical areas.",[29,3326,3327,3330],{},[145,3328,3329],{},"Below 134 (\u003C40%):"," Does not meet minimum requirements.",[18,3332,3334],{"id":3333},"questions-to-ask-in-vendor-calls","Questions to Ask in Vendor Calls",[14,3336,3337],{},"Use these questions during your evaluation meetings to gather the information you need for scoring.",[14,3339,3340],{},[145,3341,3342],{},"Technical questions:",[311,3344,3345,3348,3351,3354,3357],{},[29,3346,3347],{},"\"Walk me through how you would architect this project at a high level.\"",[29,3349,3350],{},"\"What technology stack would you recommend and why?\"",[29,3352,3353],{},"\"How do you handle security throughout the development process?\"",[29,3355,3356],{},"\"What does your CI\u002FCD pipeline look like?\"",[29,3358,3359],{},"\"How do you approach performance optimization?\"",[14,3361,3362],{},[145,3363,3364],{},"Process questions:",[311,3366,3368,3371,3374,3377,3380],{"start":3367},6,[29,3369,3370],{},"\"What does a typical sprint look like for your team?\"",[29,3372,3373],{},"\"How do you handle scope changes after development starts?\"",[29,3375,3376],{},"\"What project management tools do you use?\"",[29,3378,3379],{},"\"How do you handle situations where the project falls behind schedule?\"",[29,3381,3382],{},"\"Who specifically will work on my project, and what are their roles?\"",[14,3384,3385],{},[145,3386,3387],{},"Business questions:",[311,3389,3391,3394,3397,3400,3403],{"start":3390},11,[29,3392,3393],{},"\"Can I speak with 2-3 references from recent, similar projects?\"",[29,3395,3396],{},"\"What happens if we need to pause or terminate the project?\"",[29,3398,3399],{},"\"How do you handle IP ownership?\"",[29,3401,3402],{},"\"What does your post-launch support look like?\"",[29,3404,3405],{},"\"What is included in your warranty period?\"",[14,3407,3408,3409,821,3413,197],{},"For additional guidance on evaluating whether you need an agency, a freelancer, or an in-house team, see my ",[171,3410,3412],{"href":3411},"\u002Fcompare\u002Fagency-vs-freelancer\u002F","agency vs freelancer comparison",[171,3414,3416],{"href":3415},"\u002Fcompare\u002Finhouse-vs-agency\u002F","in-house vs agency comparison",[18,3418,3420],{"id":3419},"making-the-final-decision","Making the Final Decision",[14,3422,3423],{},"After scoring all vendors, resist the temptation to choose solely based on the highest score. Consider these additional factors:",[14,3425,3426,3429],{},[145,3427,3428],{},"Cultural fit."," Did you enjoy the conversations? Do they communicate in a way that feels natural for your team? A strong cultural fit reduces friction and improves collaboration over a multi-month engagement.",[14,3431,3432,3435],{},[145,3433,3434],{},"Gut check."," If two vendors score similarly, trust your instinct about which team you would rather work with daily for 6 to 12 months.",[14,3437,3438,3441],{},[145,3439,3440],{},"References."," Call the references. Ask specific questions: \"Was the project delivered on time and on budget? Would you hire them again? What was the biggest challenge?\" The answers to these questions are often more revealing than any proposal.",[14,3443,3444,3447],{},[145,3445,3446],{},"Pilot project."," If you are deciding between two strong finalists, consider a paid pilot project (a small, defined piece of work) to test the working relationship before committing to a full engagement.",[14,3449,3450,3451,3454,3455,3459,3460,3464,3465,3467],{},"Ready to start your vendor evaluation? ",[171,3452,3453],{"href":827},"Contact App369"," about your project, or ",[171,3456,3458],{"href":3457},"\u002Fservice\u002Fconsultations\u002F","book a consultation"," ($100 per 15 minutes, paid upfront). I am happy to walk you through my process, share my ",[171,3461,3463],{"href":3462},"\u002Fportfolio\u002F","portfolio",", answer technical questions, and provide references. You can also review my ",[171,3466,2342],{"href":2341}," for transparent pricing information.",[3469,3470],"hr",{},[18,3472,3474],{"id":3473},"frequently-asked-questions","Frequently Asked Questions",[14,3476,3477],{},[145,3478,3479],{},"How many vendors should I evaluate?",[14,3481,3482],{},"Evaluate 3-5 vendors for most projects. Fewer than 3 does not give you enough basis for comparison. More than 5 becomes time-consuming and leads to decision fatigue.",[14,3484,3485],{},[145,3486,3487],{},"How long does the vendor evaluation process take?",[14,3489,3490],{},"A thorough evaluation typically takes 2-4 weeks. Here is a realistic timeline: 1 week for initial research and screening calls, 1 week for detailed proposal review and technical interviews, 1 week for reference checks and final presentations, and a few days for internal deliberation and decision. Rushing the process to save time almost always costs more time in the long run.",[14,3492,3493],{},[145,3494,3495],{},"Should I always choose the cheapest vendor?",[14,3497,3498],{},"No. The cheapest vendor is rarely the best value. Projects chosen mainly on price can end up costing more through change orders, quality issues, and delays. Instead, evaluate total cost of ownership, which includes the initial build, maintenance, opportunity cost of delays, and the potential cost of a rebuild if quality is poor. Focus on value: the vendor that delivers the best product within your budget constraints.",[14,3500,3501],{},[145,3502,3503],{},"What questions should I ask during vendor calls?",[14,3505,3506,3507,3511],{},"Focus your questions on three areas: technical approach (how they would solve your specific problem), process (how they manage projects day to day), and risk (what could go wrong and how they would handle it). The best questions are open-ended and specific to your project, not generic. \"How would you handle ",[3508,3509,3510],"span",{},"specific challenge in my project","?\" reveals more than \"Tell me about your experience.\" See the full list of recommended questions in the \"Questions to Ask in Vendor Calls\" section above.",[14,3513,3514],{},[145,3515,3516],{},"When should I use an agency versus a freelancer?",[14,3518,3519,3520,197],{},"Use an agency for projects that require multiple skill sets (design, frontend, backend, QA), projects with firm deadlines, or projects where continuity matters (an agency can replace a team member; a freelancer cannot). Use a freelancer for well-defined, smaller tasks, supplementing an existing team, or when budget constraints are severe. For a detailed analysis, read my ",[171,3521,3522],{"href":3411},"agency vs freelancer comparison guide",{"title":411,"searchDepth":412,"depth":412,"links":3524},[3525,3526,3538,3545,3553,3561,3568,3578,3586,3587,3588],{"id":1682,"depth":412,"text":1683},{"id":1692,"depth":412,"text":1693,"children":3527},[3528,3529,3530,3531,3532,3533,3534,3535,3536,3537],{"id":1699,"depth":418,"text":1700},{"id":1746,"depth":418,"text":1747},{"id":1778,"depth":418,"text":1779},{"id":1816,"depth":418,"text":1817},{"id":1854,"depth":418,"text":1855},{"id":1892,"depth":418,"text":1893},{"id":1925,"depth":418,"text":1926},{"id":1958,"depth":418,"text":1959},{"id":1988,"depth":418,"text":1989},{"id":2026,"depth":418,"text":2027},{"id":2059,"depth":412,"text":2060,"children":3539},[3540,3541,3542,3543,3544],{"id":2066,"depth":418,"text":2067},{"id":2084,"depth":418,"text":2085},{"id":2099,"depth":418,"text":2100},{"id":2114,"depth":418,"text":2115},{"id":2129,"depth":418,"text":2130},{"id":2144,"depth":412,"text":2145,"children":3546},[3547,3548,3549,3550,3551,3552],{"id":2151,"depth":418,"text":2152},{"id":2181,"depth":418,"text":2182},{"id":2211,"depth":418,"text":2212},{"id":2226,"depth":418,"text":2227},{"id":2241,"depth":418,"text":2242},{"id":2259,"depth":418,"text":2260},{"id":2274,"depth":412,"text":2275,"children":3554},[3555,3556,3557,3558,3559,3560],{"id":2281,"depth":418,"text":2282},{"id":2303,"depth":418,"text":2304},{"id":2322,"depth":418,"text":2323},{"id":2346,"depth":418,"text":2347},{"id":2391,"depth":418,"text":2392},{"id":2418,"depth":418,"text":2419},{"id":2436,"depth":412,"text":2437,"children":3562},[3563,3564,3565,3566,3567],{"id":2443,"depth":418,"text":2444},{"id":2458,"depth":418,"text":2459},{"id":2497,"depth":418,"text":2498},{"id":2515,"depth":418,"text":2516},{"id":2533,"depth":418,"text":2534},{"id":2577,"depth":412,"text":2578,"children":3569},[3570,3571,3572,3573,3574,3575,3576,3577],{"id":2584,"depth":418,"text":2585},{"id":2600,"depth":418,"text":2601},{"id":2614,"depth":418,"text":2615},{"id":2628,"depth":418,"text":2629},{"id":2642,"depth":418,"text":2643},{"id":2656,"depth":418,"text":2657},{"id":2670,"depth":418,"text":2671},{"id":2684,"depth":418,"text":2685},{"id":2705,"depth":412,"text":2706,"children":3579},[3580,3581,3582,3583,3584,3585],{"id":2749,"depth":418,"text":2750},{"id":2876,"depth":418,"text":2877},{"id":2953,"depth":418,"text":2954},{"id":3039,"depth":418,"text":3040},{"id":3116,"depth":418,"text":3117},{"id":3193,"depth":418,"text":3194},{"id":3333,"depth":412,"text":3334},{"id":3419,"depth":412,"text":3420},{"id":3473,"depth":412,"text":3474},"Guide","2026-02-18T10:00:00.000Z","Comprehensive checklist for evaluating app development vendors in 2026. 50+ criteria across technical capability, portfolio, communication, pricing, and legal.",{"readingTimeStats":3593},{"text":3594,"minutes":3595,"time":3596,"words":3597},"20 min read",19.33,1159800,3866,"\u002Fblog\u002Fapp-development-vendor-evaluation-checklist-2026","16 min",[3601,3602,3603],"how-much-does-it-cost-to-build-an-app-2026","app-development-process-step-by-step-guide-2026","best-app-development-company-mvp-2026",{"title":1660,"description":3591},[3606,3609,3612],{"title":3607,"url":3608},"Apple Developer Program, what's included","https:\u002F\u002Fdeveloper.apple.com\u002Fprograms\u002Fwhats-included\u002F",{"title":3610,"url":3611},"Google Play Console registration fee","https:\u002F\u002Fsupport.google.com\u002Fgoogleplay\u002Fandroid-developer\u002Fanswer\u002F6112435",{"title":3613,"url":509},"Supabase changelog: tables not exposed to Data and GraphQL API automatically","blog\u002Fapp-development-vendor-evaluation-checklist-2026","app development vendor evaluation, choosing app development company, app developer checklist, software vendor selection, how to evaluate app developers","https:\u002F\u002Fapp369.com\u002Fblog\u002Fapp-development-vendor-evaluation-checklist-2026\u002F","yDLHWofZXFfDUMLq4Ag9w3S0LqcJHw4Kyijnx7MRaAI",[3619,3621,3625,3627,3628,3632],{"keyword":5,"url":522,"title":5,"relevance":3620},62,{"keyword":3622,"url":3623,"title":3622,"relevance":3624},"Supabase Security Review Before Launch (2026)","https:\u002F\u002Fapp369.com\u002Fblog\u002Fsupabase-security-review-before-launch-2026\u002F",17,{"keyword":1275,"url":1656,"title":1275,"relevance":3626},13,{"keyword":930,"url":1271,"title":930,"relevance":3626},{"keyword":3629,"url":3630,"title":3629,"relevance":3631},"Replit App Rescue: 7 Problems to Fix Before Launch","https:\u002F\u002Fapp369.com\u002Fblog\u002Freplit-app-rescue-2026\u002F",12,{"keyword":527,"url":926,"title":527,"relevance":3631},1792583246279]