Is your AI-built app ready for production?
The same 13 points we inspect in the paid audit, as a checklist you run yourself. No signup, no scan, nothing to install. Answer honestly: for each point, have you actually VERIFIED it, or are you assuming? Most founders know their answer by point four. And remember: a buyer's security team counts every 'not sure' as a 'no'.
Tenant isolation
Can customer A ever see customer B's data, through any screen, API response or export?
Open two accounts. Logged in as A, change IDs in URLs and API calls to B's records. Anything comes back? That's the flaw that kills B2B deals.
Object-level authorization
If a logged-in user requests an object ID that belongs to someone else, does your API refuse?
Grab any ID from your network tab (invoice, document, user), request it as a different user. This is BOLA, the most common flaw in AI-generated backends.
Exposed keys and secrets
Is any secret key visible in your client code, page source or network tab?
View source and search for 'key'. The public anon key is fine; a service-role key in the browser means your whole database is public.
Authentication and sessions
Does logout actually invalidate the session, and do reset links expire after use?
Log out, press back, replay an old request. Reuse a password-reset link twice. Both should fail.
Two-factor authentication
Can your users, or at least admins, turn on 2FA?
If the answer is 'not built', that's a 'no'. Security questionnaires from serious buyers ask this on page one.
Roles and permissions
If a regular user calls an admin-only action directly by URL or API, is it blocked server-side?
Hiding the button is not authorization. Call the endpoint itself as a low-permission user.
Database integrity and migrations
Is every schema change a versioned migration file in git, instead of edits made live in a dashboard?
If your schema history lives in memory or in a dashboard, you cannot rebuild your database, and you will not survive your first bad deploy.
Backups and recovery
Do automatic backups exist, and have you RESTORED one at least once?
A backup that was never restored is a hope, not a backup. Time-to-restore is the number that matters.
Rate limiting and abuse
Can a script hit your login or your AI endpoint a thousand times a minute without being slowed down?
If yes, your OpenAI bill and your uptime belong to whoever finds you first.
Privacy law (GDPR / LGPD)
If a user demands deletion of their data, can you actually do it everywhere: database, backups, logs, third parties?
Personal data of EU or Brazilian users makes this law, not preference. 'We would figure it out' is a 'no'.
Behaviour under load
Do you know, from a measurement, how many concurrent users your app survives?
Not a guess, a number from a load test. Ours went from 11% success to 100% only because we measured first.
Observability and audit log
When something breaks, do you find out from monitoring, or from an angry customer?
Error tracking, uptime alerts, and a log of who did what and when. Without them every incident is archaeology.
Deploy pipeline
Do tests run before code reaches production, and can you roll back a bad deploy in minutes?
If deploying is 'push and pray', the question is not if it breaks production, but when.