Security checks before publishing a web application

Before you hit publish, take five minutes for a quick security pass. This short checklist catches the mistakes that cause most real-world problems.

The checklist

1. Access rules: can any user reach another user's data? They shouldn't.
2. Secrets: are all API keys server-side, not in the browser bundle?
3. Authentication: is anything sensitive behind a sign-in?
4. Input validation: do forms reject bad or empty input gracefully?
5. Errors: do failures show friendly messages, not internal details?
6. Permissions: does each connector key have only the access it needs?

Go deeper

For the reasoning behind each item, read the founder's guide to application security and protecting API keys. For platform details, see the Security page.