No privacy page is linked
Payment providers, app stores, and several privacy laws expect a reachable privacy page before you take anyone's details.
Fix prompt
Create a real privacy policy page at /privacy and link it from the footer on every page. It must cover what data the app collects, why, how long it is kept, who it is shared with, and how to request deletion, written for this specific app with no placeholder text and no lorem ipsum. Use the existing layout and typography so it matches the site. Do not change any other page, route, or table. When done, give me the link so I can read it and re-run the check. If this app takes payments, Stripe's readiness review reads this page, so it has to be complete.
No terms page is linked
Without stated terms you have no written basis for suspending misuse or limiting your liability.
Fix prompt
Create a real terms of service page at /terms and link it from the footer on every page. It must cover what the service is, acceptable use, payment and cancellation terms, limitation of liability, and governing law, written for this specific app with no placeholder text and no lorem ipsum. Use the existing layout and typography so it matches the site. Do not change any other page, route, or table. When done, give me the link so I can read it and re-run the check. If this app takes payments, Stripe's readiness review reads this page, so it has to be complete.
Review browser response headers
Explicit browser policies reduce avoidable exposure and make deployment behavior easier to inspect.
Fix prompt
This app sends no Content-Security-Policy header. Add one on every HTML response from the server entry. Start with default-src 'self', object-src 'none', base-uri 'self', and frame-ancestors 'none' unless the app must be embedded. Then add only the origins the app actually uses: the script and frame origins for the payment provider if there is one, the connect origin for the backend, and any font or image hosts. Because this framework injects inline scripts for hydration, use its nonce support for script-src rather than unsafe-inline. Roll it out as Content-Security-Policy-Report-Only first, load every page including a checkout if the app has one, fix each console violation, and only then switch the header to enforcing. If the project is on the older Vite stack, run the Migrate to TanStack Start action first, because static apps cannot set headers. Change nothing else and paste the final policy back to me.
Source maps are published next to the app code
Anyone can rebuild your original files, including comments, file names, and any logic you assumed was hidden.
Fix prompt
A production source map is publicly reachable at {map_url} for {bundle}, which hands anyone your readable source. Turn off source map generation for production builds in the build configuration and make sure no .map files are published. Keep source maps for the preview environment if you want them. Change nothing else, rebuild, and tell me when the .map address returns 404 so I can re-run the check.Check missing and private routes
Fallback routing can return app content where a clear missing or denied response belongs.
Fix prompt
In Lovable chat: Request a missing page and each common private path in production. Return the intended missing or denied response without internal details. Then show me the files changed and the checks run.
Remove sensitive values from logs
Production logs often outlive the request that created them and may be visible to more people.
Fix prompt
In Lovable chat: Review production logging. Remove tokens, authorization headers, full request bodies, personal details, and internal error stacks from user-facing responses. Then show me the files changed and the checks run.
Review production dependencies
Unused and outdated packages increase maintenance work and can change deployment behavior.
Fix prompt
In Lovable chat: List production dependencies, remove unused packages, review reported issues, and run the existing test and build commands after each change. Then show me the files changed and the checks run.
Serve a real missing page
A fallback that answers 200 for an address that never existed gets indexed and hides broken links.
Fix prompt
In Lovable chat: Request a made up address in production. Return a 404 status and render your own missing page on it, with a way back to the main task. Then show me the files changed and the checks run.
Follow every link on the public pages
A dead link on a launch page reads as an abandoned product.
Fix prompt
In Lovable chat: Crawl every public page, follow every internal link and every outbound citation, record the status of each, and fix or remove the ones that error. Then show me the files changed and the checks run.
Give every page its own title and description
Duplicated or missing titles leave search results and shared links showing the address instead of the product.
Fix prompt
In Lovable chat: Generate a unique title under sixty characters and a description under a hundred and sixty for every public page, from that page's own constants. Fix duplicates at the source, not page by page. Then show me the files changed and the checks run.
Set a social preview image that answers
A link with no card looks unfinished next to every other link in the same thread.
Fix prompt
In Lovable chat: Add og:image and twitter:image with a full https address, sized twelve hundred by six hundred and thirty and under two hundred kilobytes. Paste the link into a preview debugger and confirm the card renders. Then show me the files changed and the checks run.
Write alt text for every image
A screen reader announces the file name, or nothing at all, where alt text is missing.
Fix prompt
In Lovable chat: Crawl the public pages and list every image with no alt attribute. Describe what each one shows, or mark it decorative with an empty alt attribute. Then show me the files changed and the checks run.
Compress the published images
On a phone connection the first screen waits for the heaviest image on it.
Fix prompt
In Lovable chat: Export every image at the size it is displayed, serve a modern format with a fallback, keep the largest under a few hundred kilobytes, and record the size of each one. Then show me the files changed and the checks run.
How fast the page is for a real visitor
Whether the first screen arrives quickly on a phone connection. This check reads the page once from a server, which says nothing about what a visitor on a train sees.
A URL cannot verify this. A Launch Review can.
Fix prompt
Run Lighthouse on the published address with the mobile profile and a slow connection, and read the largest contentful paint.
Colour contrast in the interface
Whether text and controls stay readable against their background, including muted text, placeholders, disabled buttons and focus outlines.
A URL cannot verify this. A Launch Review can.
Fix prompt
Run an accessibility audit on the published pages and check every pairing reaches four and a half to one for body text and three to one for large text and controls.
Whether your forms refuse automated submissions
Whether a script can post your public forms repeatedly. Sending test traffic at your forms is not something an outside check should do uninvited.
A URL cannot verify this. A Launch Review can.
Fix prompt
Post your own form fifty times in a minute with a script and see whether anything slows it down or refuses it.
Whether the cookie choice is honoured
Whether a banner appears where it is required, and whether declining actually stops anything being stored.
A URL cannot verify this. A Launch Review can.
Fix prompt
Open the site in a clean browser, decline, then read the cookies and local storage and confirm nothing beyond the choice itself was written.
Whether the first screen asks for one thing
Whether a visitor arriving cold knows the single next step. That is a judgement about your product, not something a request can read.
A URL cannot verify this. A Launch Review can.
Fix prompt
Show the first screen to someone who has never seen it and ask what they are meant to do next.
Keep privileged Supabase work on the server
Privileged reads and writes need an authenticated server boundary.
Fix prompt
In Lovable chat: Review every privileged Supabase read and write. Keep it inside an authenticated server function and test the function with two accounts. Then show me the files changed and the checks run.
Match Supabase grants to row policies
A row policy cannot help when the intended role lacks table access, and broad grants expand exposure.
Fix prompt
In Lovable chat: Review table grants and row policies together. Grant only the operations each role needs, then test allowed and denied requests through the app. Then show me the files changed and the checks run.
Test session expiry
Expired sessions must stop protected work and return people to a recoverable sign-in state.
Fix prompt
In Lovable chat: Expire a session during a protected read and write. Confirm access stops, unsaved input is preserved where possible, and sign-in returns to the intended page. Then show me the files changed and the checks run.
Define personal-data retention
Keeping personal data without a time limit increases operational and privacy obligations.
Fix prompt
In Lovable chat: List each personal field, why it is collected, its retention period, and the deletion job or manual process that enforces that period. Then show me the files changed and the checks run.
