65The pre-launch checklist

Run down this list before showing the project to people.

Secrets. Not one key in the code or in history. Repository private if you're unsure.

Data access. If there's a database, check that a stranger can't read someone else's things. That's the mistake nearly everybody makes. On Supabase and Firebase this means the access rules (Supabase calls them RLS): both stories from the secrets node above were exactly that, a table with no rules. Ask the AI to check every table.

Forms. Anything a person types should be validated. Otherwise one day somebody types something else.

Dependencies. The libraries your project stands on can have holes too. Ask the AI to check that none of them are versions with known vulnerabilities (for JavaScript the npm audit command does this).

Errors. Check that a failure shows the user a sensible message, not your project's internals with paths and versions.

Mobile. Open it on a phone and poke it.

Speed. Open it on a slow connection. If it takes more than a few seconds, half the visitors leave.

What happens under load. If a thousand people suddenly like it, does it survive? At least have a rough idea.

The simplest way to work through this list is to hand it to the AI. "Go through this list against my project and tell me where the holes are." It'll do it better and faster than you will by hand.