Is your AI-built app ready to launch?

AI tools often put secret keys where anyone can find them.

• No secret keys or passwords can be seen in the browser Must fix before launch

  A leaked payment, database or AI key lets anyone take money, read data or run up your bills. Search your page source for "key", "secret" and "sk_".

• Your code is private, and any key that's ever been in the code, a chat or a screenshot has been replaced Must fix before launch

  Deleting a key from the code doesn't remove it from the code's history. Make a new one at the provider and switch the old one off.

• Every page uses https, including on your own domain Must fix before launch

  Browsers warn people away from sites without the padlock, and sign-in details could be read on the way.

The most common problems in AI-built apps are here.

• Each customer can only see and change their own data Must fix before launch

  Sign in as two test users and try opening each other's pages and records. If one can see the other's, so can strangers.

• Database security rules are switched on (for example Supabase row level security or Firebase rules) Must fix before launch

  Without them, anyone with your app's public key can read or change every table directly, without using your app at all.

• Admin pages and actions are checked on the server, not just hidden Must fix before launch

  A hidden button can still be pressed. The server has to check who's asking, every time.

• Sign-up, sign-in, sign-out and password reset all work, and the emails arrive Must fix before launch

  Check the emails reach a real inbox rather than spam, and come from an address on your own domain.

• Repeated wrong passwords are slowed down, and admins use two-step sign-in Soon after launch

  It stops people guessing passwords, and protects the accounts that can change everything.

Where mistakes cost real money.

• Your server confirms every payment with the provider before giving access (for example with Stripe webhooks) Must fix before launch

  If your app trusts the browser to say "paid", anyone can say it. Only trust what the payment provider tells your server.

• Live payment keys have replaced test keys, and the secret key stays on the server Must fix before launch

  Test keys take no real money, and a live secret key in the browser gives anyone full access to your account.

• You've tried a failed card, a refund and a cancelled subscription Must fix before launch

  These are where payment code most often breaks, and customers notice straight away.

• Customers get receipts or invoices, with VAT shown if you're VAT registered Soon after launch

  Customers expect them, and business customers need them for their accounts.

What happens to your customers' information.

• Backups run automatically, and you've restored one to check it works Must fix before launch

  A backup you've never restored is a hope, not a plan.

• You know where your users' data is stored and who can get to it Must fix before launch

  UK GDPR expects you to know, and customers and investors will ask.

• There's a separate test version, so changes aren't tried out on real customers Soon after launch

  Building straight on the live app is how a small change takes everything down.

Something will go wrong eventually. Find out before your customers do.

• You're told when the app goes down or errors happen Must fix before launch

  Otherwise your customers find out first, and many of them won't tell you.

• Error messages don't show code, database details or keys Must fix before launch

  Detailed errors help attackers. Show a friendly message and keep the details in your logs.

• You can go back to the last working version in minutes Soon after launch

  When a release goes wrong, undoing it quickly matters more than finding the cause.

Usage-based services can surprise you.

• Every paid service has a spending limit or a billing alert Must fix before launch

  A bug, a busy day or someone misusing your app can turn into a large bill overnight.

• If your app uses AI, each user has a limit on how much they can use Must fix before launch

  Every AI request costs money. Without a limit, one user or one script can run up hundreds of pounds.

• You know your monthly running costs now, and at ten times the users Soon after launch

  So your prices cover your costs as you grow, with no surprises.

The basics every UK app needs.

• A privacy policy says what you collect, why, and who you share it with Must fix before launch

  UK GDPR requires one, and the app stores and payment providers ask for it.

• Analytics and advertising cookies only start after people agree Must fix before launch

  UK law (PECR) requires consent first. A banner that sets them anyway doesn't count.

• Your website shows your company name, number and registered office Soon after launch

  UK companies must show these on their website.

• You've checked whether you need to pay the ICO data protection fee Soon after launch

  Most organisations that handle personal data must pay it. The ICO website has a quick check.

How it feels to the people using it.

• The main pages work on a phone, with nothing cut off or too small to tap Must fix before launch

  Most people will open your app or website on a phone first.

• Pages load in a few seconds on a phone connection Soon after launch

  Slow pages lose visitors and rank lower in search. Google's PageSpeed Insights is a free check.

• It works with a keyboard and a screen reader, and text is easy to read Soon after launch

  It makes your app usable by everyone, and larger customers will ask about it.

Only if you're putting a mobile app on the App Store or Google Play.

• The Apple and Google developer accounts are in your company's name Must fix before launch

  Moving an app to another account later is slow, and a personal account shows your own name in the store.

• The app does more than show your website, links to a privacy policy, and lets people delete their account Must fix before launch

  These are among the most common reasons Apple and Google reject apps.

So your business never depends on one person.

• Your company owns the domain, hosting, database, code and store accounts Must fix before launch

  If a freelancer or a friend holds them, your business depends on them.

• At least two people can get into each account, with the logins kept in a password manager Must fix before launch

  So one lost phone or one person leaving can't lock you out.

• A short guide explains how it all fits together and where everything lives Soon after launch

  Whoever works on it next, including your first developer, starts in hours rather than weeks.