10 Things To Do Before Launching Your App

Note: One prompt per item. Open your app's repo in Claude Code, paste the one you're on, and make it show you what it found before it changes anything.

I run these at the end of a build, when the app works and I'm about to put it in front of people. Most of them are ten minutes. The ones that aren't, RLS and the legal pages, are the two I'd least want to skip.

None of it is hard. It's just invisible until it isn't.

1. Put API keys behind a proxy

AI puts the key in the client by default. Even in a native app, where people assume it's hidden, it isn't — apps get decompiled.

Search my whole codebase for API keys, tokens, and secrets that reach the
client, including anything in a public env var or hardcoded into a fetch call.
Move each one behind a server route or edge function that holds the key and
forwards the request, so the browser only ever calls my own endpoint. Show me
the list of what you found before you change anything, and tell me which keys
I now need to rotate.

2. Check Row Level Security

The one most people miss. A table that's readable with the anon key is readable by anyone who opens devtools — that's how the Tea app leaked private messages.

List every table in my database and tell me which ones have Row Level Security
on and which don't. Turn it on everywhere, with policies that let a user read
and write only their own rows. Then query each table with the public anon key
and show me, table by table, exactly what comes back.

3. Add Privacy Policy & TOS

Both stores want them, and they have to match what your app actually collects, so generate them from your code instead of a template.

Scan my code for every piece of user data I collect, store, or send to a third
party. Write a Privacy Policy and Terms of Service from exactly that list,
covering data use, retention, deletion rights, GDPR and CCPA, and link both
from my footer, my signup page, and my store listing. Ask me for whatever you
can't find in the repo, like company name, contact email, and jurisdiction.

4. Sanitize user inputs

Every box a user can type in is a way into your app. Including the ones you hand to an AI.

Find every place data enters my app: forms, URL params, file uploads, webhooks,
and any prompt I build out of user text. Validate and sanitize each one on the
server, not just in the browser, so nothing can be used for SQL injection, XSS,
or command injection. List every input you found and what you added to it.

5. Create a spend cap for paid APIs

A leaked key cost a friend $5k. The cap is what turns that into an annoying afternoon.

List every paid API my app calls and what one request costs me. For each one,
add a per-user and per-day cap in my own code that returns a clean error
instead of making the call, and tell me where to set the hard billing limit in
that provider's dashboard. Then tell me my worst case bill for a single day if
someone hammers every endpoint.

6. Set up subdomain app emails

Password resets and marketing blasts should leave from two different subdomains, so a spam flag on one can't take down the other.

Find where my app sends email and which provider it goes through. Split it
across two subdomains, app. for password resets and receipts, hello. for
marketing, each with its own SPF, DKIM and DMARC records. Pull the DKIM values
from my provider instead of inventing them, and start DMARC at p=none so I
don't bounce my own signup emails.

Longer version of this one, including the DNS side: 3 Things To Do After You Buy Your Domain

7. Test on mobile & desktop

I build on a desktop and most people open it on a phone. This one needs a browser the AI can actually drive, like Playwright or the Chrome DevTools MCP, otherwise it will guess.

Open my app in a real browser at 390px, 768px and 1440px wide, and walk the
whole flow from signup to the main thing it does at each size. Screenshot every
screen and flag anything that overflows, overlaps, hides behind the keyboard,
or has a tap target under 44px. Fix what you find and show me the before and
after.

8. Rate limit your API routes

Without it, one bot with a for-loop is your whole monthly bill.

List every API route in my app and mark which ones are public, which cost me
money per call, and which write to the database. Add rate limiting to each, by
IP for anonymous routes and by user ID for signed-in ones, returning 429 with a
Retry-After header. Show me the limit you picked for each route and why.

9. Add error tracking

Right now the only way you find out something broke is if somebody bothers to tell you.

Add Sentry to my app: install the SDK, wire up both client and server, and read
the DSN from an env var. Make unhandled errors and failed API calls report with
a stack trace and the user's ID, and scrub emails, tokens and anything else
personal before it sends. Then throw one test error from each side and confirm
both land in my dashboard.

10. Create an OG share image

Paste your link into a group chat. If you get a grey box, that's what everyone who shares your app gets.

Check every public page for og:title, og:description, og:image and the Twitter
card tags. Generate a 1200x630 image using my app's real name, colors and
fonts, host it at an absolute URL, and add the tags. Then fetch one of my live
pages and show me the exact tags a crawler would get.

Where I go deeper

Don't Get Hacked: Security Checklist covers 1, 2 and 4 as a full audit, in one prompt.

Don't Get Sued: App Pre-Launch Checklist covers 3, plus the claims and trademark side.

⚠️ General info, not legal or security advice.