Run a security check before launching a web app

Use this guide before your web app goes live, or before a major update, especially if much of the code was written with AI help. Have access to your code, hosting settings and a list of the data your app stores. For apps handling payments or sensitive data, also consider a professional security review.

Step by step

1. Search for exposed secrets

   Search your code and its version history for passwords, API keys and tokens. Move any you find into environment variables or a secrets manager, and change the exposed values, since removing them from code does not make old copies safe. Check that configuration files with secrets are excluded from version control.