Shipping with Lovable, Bolt, or Cursor is a real achievement — you turned an idea into a working product without an engineering team. Now comes the part the tools don't mention: the app is in production, and production has rules. Here are five questions worth ten minutes today. Every one of them is checkable without writing code.
1. Can you get back in?
Open a private browser window and log into your hosting, your database, your domain registrar, and your payment provider — from scratch. If any login lives only in a co-founder's head, a builder's inbox, or a browser session you're afraid to close, fix that first. Ownership means access, and access means tested credentials in a password manager you control.
2. Does a backup exist — and has anyone ever restored one?
Find the backup setting in your database provider and read it carefully. "Backups enabled" is a start, not an answer. The real question is whether a restore has ever been performed. If the answer is no, schedule one against a staging copy this week and time it. An untested backup is a hope with a checkbox.
3. Are your keys where strangers can read them?
Open your live site, view the page source, and search for anything that looks like a secret: key prefixes of your payment or AI providers, database connection strings, long random tokens. AI builders routinely place secret keys in client-side code, where anyone can read them. If you find one, rotating it — generating a new key and revoking the old one — matters more than deleting it from the page, because copies may already exist.
4. Will you notice when it breaks?
If your app went down right now, what would tell you — a monitoring alert, or a customer email three days later? A free uptime monitor pinging your site every few minutes takes fifteen minutes to set up and removes the most embarrassing failure mode a business can have: not knowing.
5. What happens when a payment webhook fails?
Payment providers deliver events — renewals, cancellations, disputes — via webhooks, and webhooks fail quietly: a timeout here, a changed URL there. Check your provider's dashboard for failed deliveries. A backlog of failures usually means revenue is leaking somewhere nobody is looking.
If some answers were "I don't know"
That's the normal result, not an embarrassing one — these are operations questions, and nothing about building with AI teaches operations. Work through them yourself with the notes above, or have a Health Check answer all five with evidence, in writing, within five business days.