Free Checklist
A free security checklist for AI-built apps.
Most serious exposure in AI-built apps comes down to a short list of checks: access control on your data, keys handled correctly, functions and storage locked down, and auth configured. Work through this free checklist and you will close the gaps behind nearly every serious finding we see.
You can catch most of it yourself, for free.
A full audit finds everything, but you do not need one to close the most common holes. The exposures that account for the majority of serious findings follow a pattern, and the pattern is checkable by hand. This checklist is the honest version of that: the same ground we cover first, written so you can run it on your own app today.
Access control
Run the two-account test: create two users and confirm neither can reach the other's data or actions through any route. Confirm row-level security or security rules are on for every table or collection that holds real data, with correct rules for both reads and writes. Test as no user at all: hit your endpoints and query your database with just the public key and confirm only public data comes back.
Keys and secrets
Confirm that only publishable keys, a Supabase anon key, a Firebase config, a Stripe publishable key, live in your front-end code. Confirm no secret key, a service-role key, a Stripe secret key, a database password, has shipped to the browser or sits in your git history. If any secret is exposed, rotate it now.
Functions, storage and configuration
Check that any database function callable with the public key has its own authorisation check, especially functions that create records or mint tokens. Check your storage buckets: which are public, which allow anonymous uploads, and whether private files are actually private. Confirm your backend is not in a wide-open test mode left over from development.
Auth
Confirm email confirmation and password rules match your intent, and that role or plan changes cannot be triggered from the client without a server-side check. Make sure a user cannot make themselves an admin by editing a request. These are the flows that turn an ordinary account into a privileged one.
When to bring in an audit
This checklist closes the common gaps, and running it honestly puts you ahead of most AI-built apps. What it cannot do is guarantee coverage of every endpoint and table, or catch the subtler cases, because doing that reliably means testing your whole surface from the outside. If your app handles real user data, money or anything you cannot afford to expose, that systematic version is what our audit provides.
Common questions.
- Is this checklist really free?
- Yes. Everything here is something you can check yourself with no tools beyond a browser and two test accounts. We would rather you close the obvious holes for free than leave them open.
- If I pass every check, is my app secure?
- You will have closed the most common serious gaps, which is a real improvement. It does not guarantee full coverage or catch subtler flaws, so treat a pass as a strong start rather than a clean bill of health.
- What if I find something I cannot fix?
- That is a good reason to book an audit. We will find everything of that kind, hand you the fix for each, and re-review once you have applied them.
Related services.
Let's build something real.
Tell us about your app or idea. You'll get a clear plan and a fixed quote back within 24 hours.