Walk through a customer's day
Use a fresh browser session and a new account, not the account you built with. Test the real public URL on both a phone and a desktop. Write down what you expect before testing; a screen changing colour is not proof that the underlying job succeeded.
- Sign up, sign in, sign out and recover access to an account.
- Complete the main journey: create, edit, save, reload and delete where appropriate.
- Submit each form and confirm it reaches the intended system.
- Open a saved deep link directly and refresh it.
- Try empty, invalid and unusually long input. The app should explain what needs fixing.
Check whose data is whose
Create two ordinary test accounts. A record belonging to one should not become readable or editable by the other simply by changing its identifier. Test access through the underlying request as well as the screen: hiding a button does not enforce permission.
Confirm that private credentials are absent from browser assets and source control. Review database policies and uploaded-file permissions. If your app uses Supabase, check Row Level Security policies for the tables the browser can reach, including how they behave for signed-out users.
Follow the money and the messages
- Check which payment credentials are test mode and which are live. Verify the provider's production setup before taking real payments.
- Confirm signed payment events, duplicate handling and the cancellation or refund journey relevant to your product.
- Check outbound email delivery and failure handling; a success toast alone proves very little.
- Put limits around expensive AI calls, uploads and repeated requests.
- Check whether a budget setting actually stops spending or only sends a notification.
Leave yourself a way back
Take a backup where your data service supports it, and learn what restoring it would involve. A database migration can make an old code release incompatible, so rolling back code and restoring data are separate decisions.
Know where errors appear, who receives alerts and who owns the domain, hosting and billing accounts. Keep a short record of the version you launched and any issues you knowingly accepted. Start with a small audience and watch what happens before making a much bigger promise.
A few fair questions.
Should every item block my launch?
Judge the consequence. Exposed private data, broken sign-in or unreliable payment handling deserve attention before customers rely on the app. A minor visual issue may be an acceptable follow-up. Record the decision.
Can my AI assistant run these checks?
It can help create test cases and inspect code. Ask for evidence of what it actually executed and against which environment. Have a person verify the important customer journeys and any consequential changes.
What should I send you for an audit?
Start with the builder or framework, a brief description of the app, its current hosting and your main concerns. Use the form; we'll arrange appropriate access separately. Don't send passwords or API keys.