Verify authentication uses established providers (Supabase Auth / Clerk / Auth0).

Audit source code and bundle outputs for exposed private API keys or database credentials.

Ensure PostgreSQL tables enforce Row-Level Security so User A cannot read or modify User B data.

Validate all API request bodies, query params, and form inputs with strict Zod schemas.

Cap request frequencies on OpenAI/Resend endpoints and public auth forms to block bot attacks.

Audit installed npm packages for known vulnerabilities and clean up unused dependencies.

Verify cookie-based session requests are protected against cross-site request forgery.

Restrict uploaded file types, sizes, and storage paths to prevent malicious uploads.

Verify Stripe/other webhook payloads using signature checks before trusting them.

Confirm admin-only routes and actions check user role server-side, not just hide UI elements.

Ensure OpenAI/Anthropic/paid API calls are proxied through your server, never called directly from the browser.

Check for unsafe rendering of user-generated content (markdown, HTML, rich text).

Ensure password reset and email verification tokens expire and are single-use.

Ensure passwords, tokens, and PII are never written to logs or returned in error responses.

If the app has organizations/workspaces, confirm one tenant cannot access another tenant's data.

Wrap UI in Error Boundaries and return clean JSON errors from API routes.

Confirm automated daily database backups and perform a 5-minute restoration drill.

Set up automated uptime ping alerts and error tracking (Sentry / Highlight).

Verify CORS origin headers, production env keys, and HTTPS redirect rules.

Add missing database indexes on foreign keys and paginate large table lists.

Add baseline HTTP security headers to prevent clickjacking and reduce injection attack surface.

Ensure duplicate payment events or double-clicked checkout buttons cannot double-charge or double-fulfill.

Provide a real way for users to delete their account and associated data.

Verify meta tags, sitemap, robots.txt, and OpenGraph previews are correctly configured.

Confirm transactional emails (signup, reset, receipts) actually land in the inbox, not spam.

Set spending alerts on hosting, database, and AI API usage to avoid surprise bills.

Confirm changes are tested in a non-production environment before deploying to real users.

Ensure slow third-party API calls (AI, payment, email) have timeouts and don't hang the whole request.

Verify core flows (signup, checkout, main dashboard) work on mobile viewport sizes.

Check color contrast, image alt text, and basic keyboard navigation across core pages.

Check dependencies for copyleft licenses (GPL/AGPL) that may conflict with a closed-source product.

Give users a way to export their own data, separate from account deletion.

Offer 2FA (TOTP or email code) at least for admin or high-value accounts.

Confirm the privacy policy actually lists every third-party service that processes user data.

Ensure changing a password kills all other active sessions/tokens for that account.

If users can post content visible to others, provide a way to report and remove abusive content.

Find N+1 query loops, missing joins, and repeated per-item database calls that silently tank performance.

Check if changing a predictable ID in a URL or API call lets a user access someone else's resource.

Check if the server fetches URLs supplied by users (e.g. for previews or webhooks) without restriction.

Check if a client can set protected fields like role, isAdmin, or price directly in a request body.

Check if API responses return entire database rows, including password hashes or internal-only fields.

Check if S3/R2/storage buckets are set to public read or write when they should be private.

Check that debug routes, framework admin panels, and .git folders are not reachable in production.

Confirm session cookies are set with HttpOnly and Secure flags so they can't be read by JavaScript or sent over plain HTTP.

Check for double-booking, overselling, or duplicate-submission bugs caused by concurrent requests.

Check if prices/balances are stored as floats instead of integer cents or a decimal type.

Check that multi-step operations (create order + charge payment + update inventory) are wrapped in a transaction.

Add caching to frequently-read, rarely-changing data instead of hitting the database on every request.

Prevent a cache expiry from causing every concurrent request to hit the database at once.

Confirm the app uses connection pooling and won't exhaust the database's max connections under load.

Confirm a new session ID is issued on login, rather than reusing the pre-login session.

Check if JWTs or session tokens are stored in localStorage/sessionStorage instead of an HttpOnly cookie.

Check that cookies aren't scoped broader than necessary (e.g. set on a parent domain, exposing them to unrelated subdomains).

Confirm sessions expire after a reasonable absolute lifetime and after a period of inactivity.

Check that service credentials (DB, storage, third-party APIs) use the minimum permissions needed, not full admin access.

Confirm timestamps are stored in UTC and converted to local time only for display.

Check that related tables have proper foreign key constraints instead of relying on application code alone.

Check that list endpoints have an enforced maximum page size, not just an optional one.