There's a specific moment that matters more than most builders treat it: the point right before an app goes from "something I've been testing myself" to "something a real stranger is about to use." It deserves ten focused minutes of its own, separate from whatever testing already happened while building. Here's a concrete, checkable list for exactly that moment.
The list
- Open your app in an incognito or private window, logged out entirely, and see what you can reach without ever signing in.
- Log in as one test account, note a URL containing an ID for something that's yours, then log in as a second test account and try that same ID.
- Open your browser's developer tools, check the Network tab, and see whether any API responses include more data than what's actually shown on screen.
- Search your own repository or codebase for the word "key" or "secret" and confirm nothing real is sitting in code that could end up public.
- Try to trigger an error deliberately, a bad input, a missing field, and check whether the message shown back is generic rather than a raw technical error.
- If your app accepts uploads, try uploading a file type you shouldn't be able to, and see if anything actually stops you.
- Check whether your database or backend service has any public, unauthenticated way to reach it directly, outside of your app's own interface.
What this list is and isn't
This isn't a full audit, and it isn't a substitute for a proper security pass, especially once real money or sensitive data is involved. It's a floor: seven checks that take about ten minutes combined and catch a meaningful share of the most common, most damaging gaps I see in apps that skip this step entirely.
Why this specific moment matters
Once real users are in an app, real data starts accumulating fast, and any gap that existed quietly during testing stops being quiet the moment someone with no reason to be careful, or every reason to look for a way in, actually shows up. Ten minutes before that first real user is one of the highest-leverage checks available anywhere in the build process, precisely because of what it happens right before.
Save this list. Run it before the next app you ship, not just this one.