{"id":"vibe-sb-deploy-checklist-no-secrets","audience":"small-business","category":"coding","track":"coding","technique":"constraints","title":"Write a safe launch checklist for an AI-built booking app","free":false,"task":"Your AI-built salon booking app is about to go live. Write a deploy checklist of exactly 6 numbered checks, each starting with a verb, that you can tick off before launch. It must deal with the secret key you can see in the code, the public repo, and real customer data. Plain text, no code blocks, under 140 words.","materialLabel":"Your launch notes (attached to your prompt automatically)","material":"Launch notes - Velvet & Vine Salon booking app (built with an AI app builder, exported to GitHub)\n\n- App lets clients pick a stylist, a service and a time, and leave their phone number.\n- Text reminders go out through a texting service. The builder put the texting API key straight into the file src/sms.js (I can see it on line 4: SMS_KEY = \"tx_live_...\").\n- The GitHub repo is PUBLIC right now (I made it public to show my nephew).\n- While testing, I added 40 fake bookings, plus 3 real clients' names and phone numbers.\n- The database has a setting \"anyone with the link can read all bookings\" turned on from testing.\n- Domain: book.velvetandvine.example is ready.\n- I'd like a dark mode someday.\n","rules":[{"type":"numberedItems","count":6},{"type":"plainText"},{"type":"maxProseWords","max":140}],"mistakes":[{"title":"Moving the key but not replacing it","why":"The AI says 'use an environment variable' but the old key is already public.","fix":"Add: \"The key was public, so replace (rotate) it.\"","checks":["r0"]},{"title":"Missing the open database","why":"The AI focuses on the code and skips the read-all setting.","fix":"Add: \"Turn off 'anyone with the link can read all bookings'.\"","checks":["r1"]},{"title":"Leaving test data in","why":"The AI forgets the real names and numbers mixed in with test bookings.","fix":"Add: \"Delete test bookings, including the 3 real clients.\"","checks":["r2"]},{"title":"Generic launch advice","why":"The AI lists SEO, analytics and dark mode.","fix":"Add: \"Only security and data checks from my notes, 6 numbered lines.\"","checks":["numberedItems","maxProseWords"]},{"title":"Code instead of steps","why":"The AI writes .env files and code in code blocks.","fix":"Add: \"Plain text, no bold, no code blocks. Plain steps starting with a verb.\"","checks":["plainText"]}],"promptHints":[{"label":"Handles the key","patterns":["rotate","replace the key","environment variable","secret"]},{"label":"Mentions the public repo","patterns":["private","repo","github"]},{"label":"Locks down the data","patterns":["read all","database","permission"]},{"label":"Cleans test data","patterns":["test (data|bookings)","delete","real clients"]},{"label":"Caps the length","patterns":["\\d+\\s*words"]}],"hint":"A key in public code is already leaked, even if you move it. Tell the AI about the key, the repo, the open database setting and the real data in your tests.","rubricLabels":["It says to move the texting API key out of src/sms.js into the builder's environment variables or secrets setting, and to replace (rotate) the key because it was exposed","It says to make the GitHub repo private (or remove the key from it), and to turn off the setting that lets anyone with the link read all bookings","It says to delete the test bookings, including the 3 real clients' names and phone numbers, before launch"]}