A practical launch-day review

How to security-review a web app before launch

A pre-launch security pass is not a penetration test. It is a disciplined check for common mistakes that can expose data, weaken access boundaries or reveal implementation details.

Review the deployed version, not only your local project. Build settings, redirects and production environment variables can change what is publicly reachable. Start with a written scope: the production domain, public routes, test accounts and any systems you have permission to inspect.

Check the client bundle for secrets

Search generated JavaScript, source maps and publicly served configuration for keys that should never be exposed. Some public client keys are expected, but they still need the provider’s intended access controls. Rotate any credential that was accidentally published; deleting it from the current build does not make a leaked secret private again.

Review access and test routes

Try the app as a logged-out visitor and as a low-privilege test user. Confirm that admin pages, debug routes, preview deployments and test accounts are not accidentally open. Check that server-side authorization protects data even when someone calls an endpoint directly.

Inspect response headers and error behavior

Review security headers such as Content Security Policy, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Their correct values depend on your stack; copying a strict policy without testing can break the app. Trigger a harmless error and confirm the response does not expose stack traces, internal paths or private environment details.

Turn findings into a fix-and-recheck loop

For each issue, record the exact route or evidence, risk, owner and fix. Prioritize confirmed exposure and broken access controls before cosmetic hardening. After changes, repeat the check on the production deployment and retain a short dated record.

Use the free pre-launch security review checklist as a first pass, then see VibeShield for local-first Mac checks of live app risks. For high-risk systems, regulated data or a real incident, involve a qualified security professional.