bowline-check
Does your AI-built prototype survive contact with real users?
Lovable, Bolt, v0 and Cursor will get you an app that demos beautifully. We take these apart for a living, and they fall over in the same seven places every time. This tool checks yours for all seven, locally, in about a second.
npx bowline-check # scan the current directory
npx bowline-check ./my-app # or any pathNothing runs, nothing uploads. Static analysis, zero dependencies, MIT.
The seven checks
| What it looks for | |
|---|---|
| Secrets | API keys committed in source, secrets behind NEXT_PUBLIC_/VITE_ prefixes, OpenAI running in the browser, uncovered .env |
| Accounts | Account deletion (an App Store requirement), password reset, Supabase without Row Level Security, queries that never scope to the signed-in user |
| Data | No migrations (the schema was clicked into existence), single-table smell |
| AI cost | LLM calls with no rate limit, no per-user quota, no max_tokens — the £400-overnight class of bug |
| Payments | A checkout that works once: no webhooks, no failed-renewal or refund handling |
| Store review | Missing privacy manifest, missing in-app deletion, tracking SDKs without ATT strings |
| Under load | No indexes, no health endpoint, slow work inside request handlers, no error monitoring |
Output is a scored card:
✗ Secrets OpenAI API key committed in source
✗ AI cost LLM calls with no rate limiting anywhere
...
33/100 This is a prototype, not a product. (5 critical, 1 warnings)--json for machines, --ci to fail pipelines on criticals, --verbose for file paths.
Where these checks come from
Not from vibes. Each one is a thing that actually broke in products we shipped and ran — a paywalled AI app on Google Play, a clinical AI assistant that was acquired, and the incidents in between. The checks are the scar tissue, written down.
A clean score is necessary, not sufficient — this is static analysis and it can't see your runtime. If you want the full teardown (what breaks at 500 users, and what each fix costs), that's free and takes 30 minutes: bowline-studio.pages.dev
Built by Bowline — a two-person London studio. We ship AI products in four weeks, fixed price, built to hold.