Is my AI-built app safe to launch? A ten-minute check

Because a builder makes what you asked for, and you may not have asked for security. An app can look finished and still let one user see another user's data.

The first-ranked web app risk in the OWASP Top 10:2025, a standard awareness list from the Open Worldwide Application Security Project, is broken access control. That means people can reach data or actions they should not have permission for (OWASP Top 10:2025, A01 Broken Access Control, checked 6 October 2026). Check 3 below is aimed at exactly that.

An API (application programming interface) key is a secret password that lets your app use another service, such as payments or an AI service. Anyone who copies it can use that service as you, and you may pay for it.

• Keys belong in settings stored on your hosting, often called environment variables, not in the code that loads in a visitor's browser.
• Ask your builder: is any key visible in the code that runs in the browser?
• If a key was ever visible, replace it with a new one in that service's settings. Hiding it later is not enough.

Authentication is how your app checks who someone is. On the live app, not your laptop:

• Sign up with a fresh email address, log out, then log back in.
• Reset the password and make sure the email arrives.
• Log out, then paste a private page's address into the browser. You should be sent to the login page.

This is the most important check. Make two test accounts, A and B.

• In account A, create something private, such as a note or an order.
• Copy the address of that page.
• Log in as B in a private browser window and open that address. If B can see A's data, stop and fix it before launch.

If your app's addresses include a number, such as an order number, try changing it by one while logged in as B. In our reading, that is a common way private data leaks.

Find out whether your database makes backups and how to restore one. A backup you have never restored is a hope, not a backup. If your service offers automatic backups, turn them on.

If you take money, use your payment service's test mode to make one test purchase. Check that the user gets access only after the payment succeeds. Then cancel or refund it, and check that access ends if it should.

If you collect emails or any personal data, you need to tell people what you collect and why. Depending on where you and your users are, privacy laws may require it. Write a plain privacy policy page and link it from your sign-up form. This is educational, not legal advice.

A lot. It does not test for attacks a skilled person would try, the code libraries your app depends on, or how your app behaves under heavy use. That is what a security audit by an expert is for.

The strongest case against launching after only this check: if you hold health records, financial details or children's data, a leak can seriously harm people. The missing fact is what data you hold. If it is sensitive, pay for an expert review before launch.

Make sure the app actually works live, not just on your laptop: why your app works on your laptop but not for friends. For everything beyond safety, what you might be forgetting before launch covers the rest.

Block ten minutes and run the six checks on your live app, in order. Write down every check that fails. Fix check 3 first if it failed, then check 1, before you invite anyone new.