App launch checklist

Check your app before you launch

The checklist from the video, with a short explanation for each item.

Start here

This is a starting checklist, not proof that an app is secure. Check each item against your own app and stack.

The 20 checks

  1. Keep secret API keys out of your frontend.

    Only keys explicitly designed to be public belong in client code.

  2. Keep .env files out of Git and public folders.

    Private environment files must not be committed or served.

  3. Scan your Git history for leaked secrets.

    Deleting a key from the latest file does not remove earlier copies.

  4. Rotate any keys you have accidentally exposed.

    Replace and revoke exposed credentials.

  5. Check permissions on the server, on every request.

    A login alone does not give access to every record or action.

  6. Never trust user IDs, roles, or prices sent by the frontend.

    Derive identity from a verified session and check roles and prices on the server.

  7. Make sure users cannot access each other's data.

    Test viewing, editing, downloading and deleting another account's records.

  8. Lock down your database and private file storage.

    Enforce access rules at the data and storage layers.

  9. Protect admin actions, even when called directly.

    Check the server endpoint, not just the visible admin page.

  10. Test login, logout, and password resets.

    Check session expiry and reset-link expiry and reuse.

  11. Rate-limit login, signup, and expensive API calls.

    Enforce limits on the server.

  12. Add usage caps so one user cannot drain your AI budget.

    Track per-user consumption and stop expensive requests when the cap is reached.

  13. Validate inputs on the server.

    Check types, ranges, lengths and allowed fields.

  14. Use safe database queries to prevent injection.

    Use parameterized queries; do not join raw input into query strings.

  15. Make sure user content cannot run scripts.

    Escape content when displaying it; sanitize allowed rich HTML with a maintained library.

  16. Restrict file types and sizes for uploads.

    Check actual content and limit upload size; do not trust the filename alone.

  17. Verify payments on the server before unlocking paid features.

    Verify payment-provider events and handle repeated events safely.

  18. Turn off debug mode and keep secrets out of errors and logs.

    Public errors should not expose internal configuration or credentials.

  19. Back up your data and test restoring it.

    A backup is useful only if you can recover the data.

  20. Test with two accounts, then test without logging in.

    Check that unauthorized requests are denied across sensitive actions.

Keep a copy

Copy the 20 checks 
1. Keep secret API keys out of your frontend.
2. Keep .env files out of Git and public folders.
3. Scan your Git history for leaked secrets.
4. Rotate any keys you have accidentally exposed.
5. Check permissions on the server, on every request.
6. Never trust user IDs, roles, or prices sent by the frontend.
7. Make sure users cannot access each other's data.
8. Lock down your database and private file storage.
9. Protect admin actions, even when called directly.
10. Test login, logout, and password resets.
11. Rate-limit login, signup, and expensive API calls.
12. Add usage caps so one user cannot drain your AI budget.
13. Validate inputs on the server.
14. Use safe database queries to prevent injection.
15. Make sure user content cannot run scripts.
16. Restrict file types and sizes for uploads.
17. Verify payments on the server before unlocking paid features.
18. Turn off debug mode and keep secrets out of errors and logs.
19. Back up your data and test restoring it.
20. Test with two accounts, then test without logging in.

Official references