Your app works. That is not the same as ready.

Before the checklist, answer this honestly: apart from you, who has opened this app? And: what breaks if the answer to a request is "no"? An app that only one person has used has only one path tested. An app that never receives a "no" has never shown you what it does with one.

Most of the expensive failures are not exotic. They are a normal feature, called by someone who was not supposed to call it, at a moment that was not supposed to happen.

Group 1 — Who can read and change your data

• Log out, then open the app again. You should land on a login screen. If you see data, the page is rendered from a cached response or from a public source.
• Take a row that belongs to another account, and try to fetch it by its id. Change one number in the URL or in the network request. A "no" is what you want; a 200 with someone else's row is the single most common finding I report.
• Check the rules on the database itself, not only in your app. If your data lives in a service like Supabase or Firebase, permissions belong to that service. Buttons you hide in the interface are not permissions.

Group 2 — What the browser is allowed to know

• Search your published front-end for key-shaped strings. Open the built JavaScript and search for sk-, secret, service_role, password. A key that reaches the browser is public, whoever it belongs to.
• Look at the console and the network tab on every screen. Errors that leak table names, stack traces and email addresses are a map of your backend for anyone who looks.
• Check what your error pages say. A stack trace in production tells a stranger which framework and which version you are running.

Group 3 — Money

• Never trust a price, quantity or discount that arrives from the browser. Send a request with price: 0.01 and see if the server accepts it. The amount must be decided by your server.
• Reload the payment page after a successful payment. One order should not become two.
• Interrupt a payment, then finish it. If your app loses the link between the payment and the order, you will be reconciling by hand for weeks.

Group 4 — What happens when something fails

• Switch off your network halfway through a form. An app that loses the user's input silently is an app that loses users.
• Send the same request twice, fast. Double submissions, double e-mails and double charges come from a button that trusted the user to click once.
• Read your own error notification path. Who gets told when something breaks at 3 a.m.? If the answer is "nobody", you find out from a customer.

A self-check finds the failures you can trigger by hand. It does not find the ones that need two conditions at once: a permission check that is correct on the main route but missing on the copy of it, a webhook that can be replayed, a race between two requests that each look fine alone, an admin endpoint that is protected by obscurity instead of by a session.

That gap is the reason a review exists. Not to repeat your checklist, but to read the code where the checklist runs out — and to tell you which of the twelve checks above you actually passed, with evidence, instead of with hope.

Quick check $299 · Deep check $799 · repairs $120 per hour. Prices in USD, payment only after we agree on the scope. See what a review costs.

• My app is not launched yet. Is this checklist too early?
  Right before launch is exactly the moment: the findings are still cheap to fix, and no customer has seen the weak version.
• I built it with Lovable, Bolt, v0 or Cursor. Is that relevant?
  It changes nothing in the review. It does change the odds of a specific failure — permissions and secrets in the browser are the usual suspects, because the demo never needed them. See what breaks after launch.
• Can I just run a scanner?
  Yes, and you should. Scanners find known shapes. This checklist is what you do when the scanner is quiet and you still need to know whether a stranger can read someone else's data.
• Do you need my whole codebase?
  For a Quick check, either the repository or a working link plus the code of the pieces that worry you. See how your code is handled.