Check 1
Login is checked on the server
Hiding a page in the UI protects nothing. Anyone can call the API directly. If the server does not ask "who is this?" on every protected route, it is not protected.
Gonzalo Nediani
Three things I look at first.
These are the holes I see most in vibe-coded apps before real users show up. I check 31. The other 28 and the prompt that writes SHIP-CHECK.md stay in the Self-Check. The rules I use are free.
The three public checks
Check 2
Changing an ID in the URL should not show someone else's data
If user B can open user A's record by editing a number in the link, real users will find that. The server has to check that this record belongs to this person.
Check 3
Secrets are not in the repo or the frontend
Keys in git history, in a public env variable, or shipped to the browser get used. Only public keys belong in the client.
Passing these three does not mean you are ready. It means you survived the first pass. The other 28 stay in the Self-Check.
FAQ
Why only three checks here?
These three are the holes I see first. The full 31-point list and the prompt that writes SHIP-CHECK.md are in the $29 Self-Check. The rules are free.
Can I run the full check myself?
Yes. You paste the prompt in Cursor or Claude Code. It writes a report. It does not change your code.
Can you look at the app instead?
That's the Production Readiness Review. $297. You send the repo. In 3 to 5 days you get a video and a prioritized list. No call.
Ready when you are
Production Readiness Self-Check
29 US dollars, one-time
All 31 points, the prompt that writes SHIP-CHECK.md, and the founders group. You run it.
Get the full check, $29Production Readiness Review
297 US dollars, one-time
I look at the repo. You get a video and a list, in order.
Show me if it's ready, $297Payments are handled securely by Stripe.