How to protect your AI-built MVP before you ship

After building 20+ MVPs using Cursor, I learned one thing the hard way:

If you skip security, it’ll bite you later.

This checklist is the bare minimum I wish I had on Day 1:

1. Rate Limit Your Endpoints

Without limits, bots can hit your backend 100s of times per second.

That means:

• Crashed database
• Supabase usage drained
• Random API spikes

What to use:

• Supabase Edge Functions + rate limiter
• Vercel Middleware
• Next.js IP throttling

2. Enable Row-Level Security (RLS)

If you’re on Supabase, turn on RLS for every table.