Checklist

AI app audit checklist for non-technical founders

Use this before launch, before adding payments, or after your first customer reports something strange. You do not need to understand every line of code to know where the risk probably lives.

1. Customer data

• Can one logged-in user ever see another user's records?
• Are private files protected by server-side checks?
• Does deleting or editing data affect only the correct account?

2. Secrets and payments

• Are API keys hidden from the browser and public repositories?
• Are Stripe or payment webhooks verified on the server?
• Does subscription status come from the payment provider, not from a user-editable field?

3. AI features

• Are prompts protected from user instructions that override business rules?
• Are token costs limited per user or per workflow?
• Are AI outputs validated before they are saved, shown, emailed, or executed?

4. Reliability

• Does the app show helpful errors instead of blank screens?
• Can you roll back if a generated change breaks production?
• Do signup, login, checkout, and the core workflow have basic tests or manual runbooks?

What to do with the answers

If you answered “I do not know” to any high-risk item, treat it as an audit candidate. Unknowns around data access, payments, secrets, and AI permissions matter more than visual polish.

Get a full vibe-coded app audit or read the vibe coding security guide.