Agent WranglersApps built with AI builders
App builders such as Lovable, Bolt, Replit and v0 ship working apps fast. Lock down the database, keep keys server-side and own the code.
- Required 4
- Recommended 2
Required
Turn on row-level security for every table
RequiredWhen the browser talks to the database directly, turn on row-level security for every table and write a policy for each action.
Keep secret keys on the server
RequiredNever ship a secret key in code that runs in the browser. That covers database secret or service role keys, payment secrets and AI provider keys.
Check every sign-in and permission flow
RequiredTest sign-up, sign-in, password reset and every admin page as a stranger and as a normal user before launch.
Own the code in your own repository
RequiredKeep the app's code in a repository you control, and make sure you can build and deploy it without the builder.
Recommended
Add tests and checks before the app grows
RecommendedOnce users depend on the app, add tests and a check command before adding more features.
Know when to move off the builder
RecommendedPlan to move to a normal development setup when the app outgrows the builder. Complex permissions, background jobs and many developers are common signs.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders.