AI App Health Check

I tested with two separate accounts and confirmed neither can see the other’s data.Critical

Access rules are enforced on the server or in the database (for example Supabase row-level security), not only by hiding buttons in the interface.Critical

Admin and internal pages require a verified admin role checked on the server.Critical

Password reset, email verification and session expiry have been tested end to end.

I know exactly which personal data the app stores and where it is hosted.

Users can export or delete their data, and deleting an account really removes it.

Backups exist and I have tested restoring one.Critical

Uploaded files are private unless they are meant to be public.Critical

Payment webhooks verify the provider’s signature.Critical

Paid access is granted from subscription events, not from the thank-you page.Critical

Webhook handlers are safe to run twice, so retries never double-grant or double-charge.

Failed payments, cancellations and refunds change the user’s access correctly.

No API keys or secrets are in the front-end code or in a public repository.Critical

Test and live keys are separate, and live keys exist only on the server.Critical

Rate limits or spending caps protect paid services such as AI models, email and SMS.

Staging and production are separate environments.

Errors and downtime are monitored and someone is alerted.

I can roll back a bad release within minutes.

Dependencies are kept up to date and known vulnerabilities are checked.

A named person owns the app after launch (fixes, updates and incidents).