The app security checklist to run before you launch

The non-negotiable basics

• HTTPS everywhere, with security headers set
• Passwords hashed properly; multi-factor available for sensitive accounts
• Every input validated on the server — never trust the client
• Authorisation checked on every request, not just hidden in the UI
• Secrets (keys, passwords) kept out of the code and the browser
• Dependencies kept patched, not frozen at install-day versions

The ones people forget

Rate-limiting and abuse protection on public endpoints, sensible handling and retention of personal data, encrypted backups you've actually tested restoring, and logging that lets you see what happened after an incident. None of these are glamorous, and all of them are the difference between a bad day and a business-ending one.

Security is a habit, not a launch task

The point of a pre-launch checklist isn't to tick boxes once — it's to bake these into how the product is built so they stay true as it grows. That's why every backend we ship comes with automated tests and gets hardened as a matter of course, not as an expensive afterthought once something has already gone wrong.