How to deploy a vibe-coded app (and not leak your keys)

Beginner checklist for putting an AI-built app online: hosting, environment variables, custom domains and basic security. Updated 2026-10-15.

Keep secrets out of code. API keys go in environment variables on your host, never in files you share or commit.
Pick a host. Browser builders (Lovable, Bolt.new, Replit, v0) have a built-in publish button. For your own code, use a static/serverless host and follow its docs.
Set env vars in the host dashboard, then redeploy.
Add a custom domain by following the host's DNS instructions (usually an A or CNAME record).
Run the "Pre-launch checklist" and "Security pass" prompts from the prompt pack.
Test on your phone and in a private window before you share it.