Security checklist for AI-built apps before launch
Start with the most costly things to disclose or change: customer documents, paid features and administrative actions. Give each check a responsible person and decide what finding would stop the release.
What to prepare
Map the public URL, login, one private object, an action with side effects and external services. Record the build and environment. Do not use live payment details or working credentials as test markers.
Verification procedure
Check what an outside visitor can reach
On your own deployment, inspect a public route and the client bundle while signed out. Confirm a service file cannot disclose credentials and an admin action is denied by the server. Distinguish public configuration from a secret.
Follow a private or paid flow end to end
Give two fixture customers a record each. Check own-record access, cross-owner denial, file download and a legitimate operation after a fix. For dependencies, compare the versions in the deployed artifact with applicable advisories.
Example decisions for the first release
Block: another customer can read a synthetic private document.
Incomplete: the WAF blocked both the owner and the unrelated user.
Retest: same route and both identities on the patched build.Decision and limitations
Attach the completed checks, known gaps and the person accepting any remaining risk to the release. Fill in the downloadable checklist with the developer or studio.
What remains unverified
An empty automated report is not a launch sign-off. Payment flows, personal data and third-party integrations need separate checks tailored to your product.