This list is not theoretical. Every item is something we have found in a real application built by somebody else, usually one that looked finished.
1. Can one customer see another customer's data?
Test it properly: sign in as one account and try to open a record belonging to another by changing the address in the browser. If it opens, nothing else on this list matters. The rule that prevents it is that access is decided where the data lives, not in the screens — screens can be bypassed in about four seconds.
2. Are any keys sitting in the browser?
Open the page source and search it for anything that looks like a key. Anything the browser can see, anyone can see. Payment keys, AI provider keys and database credentials belong on the server, always.
3. Can somebody give themselves a paid plan?
If the app tells the server which plan a user is on, rather than the server deciding, then a user can tell it something else. We have found this live more than once, and it is invisible until somebody tries it.
4. Does the payment actually get verified?
A payment page that redirects back to a success screen has proved nothing. The message that confirms a payment has to come from the payment provider, and it has to be checked to be genuine before anything is unlocked.
5. Can somebody delete their account, and does it delete everything?
Files stored outside the database are not removed when database rows are. A deletion that looks complete but leaves the videos, the recordings or the uploads behind is worse than no deletion at all, because everyone believes it is done.
6. Does your privacy policy describe this product?
Not a template. If you record people, say so. If you keep recordings for a set period, say the period. If somebody connects another account, say what you take from it and what you keep. A policy that does not match the software is the one document a regulator will read first.
7. If it sends email, is that lawful where your customers are?
An enquiry is consent to reply, not consent to market. Marketing needs a separate, unticked choice, a record of what the person actually agreed to, and an unsubscribe that works immediately.
8. What happens at 3am?
Who is told when it breaks, how far back the backups go, whether anyone has ever restored one, and how quickly you can put the previous version back. If the answer to the last one is measured in hours, that is your real risk, not the code.
If you would rather somebody else ran these
An independent Security and Compliance Review is $5,500 to $8,500 — including applications you built yourself, or had built by somebody else.
We build in the order that prevents most of this: architecture first, security before features, AI last.
How we work