A security and compliance checklist for apps built fast

AI coding tools have made it possible to go from idea to working app in days. What they have not changed is what attackers look for, or what the law expects. Here is a checklist worth running before anything meets real users. It is a practical guide, not legal advice.

Access: who can see what

• Turn on access rules at the data layer, such as row-level security, so a mistake in the app cannot expose every record.
• Check authentication on every API route. It is easy to protect the pages and forget the endpoints behind them.
• Never trust the frontend. Prices, roles and permissions sent from the browser can be edited.
• Stop insecure direct object references. If changing /orders/123 to /orders/124 shows someone else’s order, the server is not checking ownership.
• Protect admin pages with a role check on the server, not by hiding links.

Attacks: the common ones

• Rate limiting on login, sign-up, password reset and contact forms.
• Input validation and escaping so text people type cannot become code on your pages.
• Parameterised queries so user input can never change a database command.
• Strict CORS rules so only your own sites can call your APIs from a browser.
• HTTPS everywhere, and CAPTCHA or a honeypot on public forms.

Production: quiet gaps

• Switch off debug mode, which can leak code and keys in error pages.
• Add security headers that stop your pages being framed or files being misread.
• Verify the signature on every incoming webhook, so a fake ‘payment succeeded’ message cannot unlock an order.
• Keep storage buckets private and check the type and size of uploaded files.
• Keep logs and alerts so you notice unusual activity.

Automated tools now exist that probe your own app the way an attacker would and report what they find. They are worth running before launch and after every big change.

Legal traps that apply from day one

Several laws apply from your first visitor, whether or not you have made a sale. Penalties are set per violation, so they add up quickly:

• Fonts and tracking. In 2022 a Munich court ordered a website operator to pay damages for loading Google Fonts from Google’s servers, sharing the visitor’s IP address without consent. Self-hosting fonts avoids the issue; this site does that.
• Session recording. Recording visitors’ sessions without clear consent has led to claims under US wiretapping laws.
• Children. Services that may attract under-13s in the US have duties under COPPA.
• Marketing email. Under CAN-SPAM, commercial emails need an unsubscribe option and a physical address; UK and EU rules add consent requirements.
• Subscriptions. Several US states require clear renewal terms next to the sign-up button.
• User uploads. In the US, registering a DMCA agent gives you safe-harbour protection for content users upload.

Check the rules that apply where your users live, and get proper legal advice before you scale.