AI app launch checklist
Before launch, verify the things that only fail with real users: a second account cannot reach the first account's data, no secret is in the browser bundle, the main flow works signed out and on a phone, money and email actually work in production, and failures are visible to you rather than silent.
Security and access
- 1Create a second account and try to read, edit and delete the first account's data.
- 2Search the deployed JavaScript for secret prefixes.
- 3Call every privileged endpoint while signed out.
- 4Confirm every public endpoint — webhooks especially — verifies its caller.
- 5Confirm no request body supplies the user id, the price or a role.
The signed-out walkthrough
Open a private window and do the whole journey as a stranger: land on the page, understand what the thing is, sign up, complete the main action. Most launch problems are found here, not in the code. Do it on a phone too — that is where half your visitors will be.
Money and mail
- Run one real payment end to end, in production, with a real card, and confirm the account state changes.
- Confirm the payment webhook is reachable and verified, not just implemented.
- Send each transactional email to yourself from the live environment.
- Confirm your sending domain is verified — unverified domains fail silently or land in spam.
- Check the refund and cancellation path exists before someone needs it.
Visibility when it breaks
The question is not whether something will fail on day one. It is whether you will hear about it from your logs or from a stranger who has already left. Confirm server errors are logged with enough detail to act on, and that you have somewhere people can tell you something is wrong.
How it looks when shared
- 1Give every public page its own title and description.
- 2Set a social preview image and check it in a link-preview tool.
- 3Confirm the domain resolves with and without www, over HTTPS.
- 4Check robots.txt does not block the pages you want found.
- 5Make sure the sitemap lists your public pages and nothing private.
The things people skip and regret
| Skipped | Consequence |
|---|---|
| Second-account test | A stranger reads someone else's data |
| Production payment test | Money arrives, access does not |
| Signed-out walkthrough | Visitors hit a blank page and leave |
| Error logging | Failures you only learn about from a complaint |
| Mobile pass | Half the traffic sees a broken layout |
Frequently asked questions
- How long should this take?
- An hour or two for a small app. The second-account test and the production payment test are the two worth doing properly.
- Can I launch without analytics?
- Yes, but you will not know whether silence means no visitors or a broken page. One basic measure is enough.
- What if I find something serious the day before?
- Delay. A quiet launch can be repeated; a data leak on launch day cannot be taken back.
Practice this in MessyDev
Reading it once helps. Doing it once sticks. These are the hands-on parts of MessyDev that cover the same ground.
Keep going
- Common security mistakes in AI-generated appsThe handful of issues that show up repeatedly in generated code — what each one looks like, why it happens, and the check that catches it.
- What happens when you deploy an app to Vercel?From commit to live URL: install, build, output, edge and server functions, environment variables and why the production build is stricter than your laptop.
- How to troubleshoot an AI-built applicationA symptom-to-cause index. Start from what you can see — a blank page, an empty list, a failed login, a dead deploy — and follow it to the layer responsible.