Free checklist
Is your app ready for real users?
Fifteen checks we run before a product takes paying customers. Written from the audits, not from a blog post. Free, as a one-page PDF, in exchange for your email.
On its way.
Check your inbox in a minute. If you'd rather have someone run the checks for you, that's the audit.
See the Launch Readiness AuditA few of the fifteen.
- Is any API key, token or password committed in the repository?
- Can an unauthenticated request read or write your database directly?
- Do admin routes check that the user is actually an admin?
- Is there a backup, and has anyone ever restored from it?
- What happens to a customer's session when they change their password?
- Are error messages leaking stack traces or internal paths to users?
- Can one user reach another user's records by changing an ID in the URL?
- Is the deploy repeatable, or does it live on one person's laptop?
- Are file uploads checked for type and size before they're stored?
- Is there rate limiting on login, signup and password reset?
The full fifteen, with what "good" looks like for each, are in the PDF.