Before launching an AI-built app, check six areas: login (OTP codes that are rate-limited and expire), permissions (each user sees only their own data, each staff member only what they need), payments (through a licensed gateway with the amount calculated on the server), data and files (minimal, encrypted, restricted uploads), secret keys (server only) and hosting (HTTPS, backups, rollback, monitoring). Then repeat the review monthly and after every major feature.
- security checklist for ai built apps
- app security checklist before launch
- how to protect my app from hackers
- how to protect customer data in my app
- vibe coding security checklist
How to use this security checklist
This is a security checklist for AI-built apps, written for an owner who does not read code. You are not expected to understand every technical detail, only to make sure each item is satisfied, either by a test you run yourself or by a question you put to the agent that it answers with evidence. If you first want to understand why flaws appear in generated code, start with is AI-generated code secure?.
We split the items into three levels so you do not delay launch for nice-to-haves, or launch while missing the basics:
| Level | When | Examples |
|---|---|---|
| Critical | Before any launch, even to ten customers | Permissions, secret keys, server-side pricing, HTTPS |
| Important | Within the first month after launch | Admin audit log, a backup restore test, role review |
| As you grow | When the team or data grows | Mandatory two-factor for staff, external security review, incident response plan |
Accounts and sign-in
- [Critical] OTP codes expire within a few minutes and work only once.
- [Critical] Limits on code requests per number and per device, with a wait between requests, plus a cap on wrong-code attempts.
- [Critical] Admin accounts use a strong password or phone sign-in, and there is no admin account with a default password.
- [Important] Signing out really ends the session, and idle admin sessions expire after a sensible time.
- [Important] An alert when an admin account signs in from a new device.
- [As you grow] Mandatory two-factor login for staff, and SSO for business customers who ask for it.
- [As you grow] For apps that need identity checks: Nafath in Saudi Arabia or UAE PASS in the UAE instead of uploading ID photos.
OTP abuse is a money problem before it is a security problem, because every message costs something. The full story is in stop fake sign-ups, OTP abuse and order fraud.
Permissions and data access
This is the most important area, because the most common flaw in quickly built apps is one user seeing another's data. The rule: the least access that gets the job done.
- [Critical] Every data request checks on the server that the user owns the data, not just in the interface. Test with two accounts and by changing numbers in URLs.
- [Critical] Admin pages do not open for visitors or customers, even if they know the link.
- [Critical] The role (owner, manager, staff, customer) is set on the server and cannot be changed from the interface.
- [Important] Each role is written down: what it sees, edits and deletes. A driver sees the address of their assigned order only, not every customer.
- [Important] An audit log for sensitive actions: who deleted an order, changed a price or exported the customer list.
- [Important] Full data exports, such as customer lists, are limited to the owner.
- [As you grow] Regular account reviews: disable departing staff accounts the same day.
Payments and money
- [Critical] Payments go through a licensed gateway (mada, Apple Pay, Visa, Mastercard, Tabby, Tamara and others), and your app never stores card numbers.
- [Critical] The final amount is calculated on the server from stored prices, and discounts are validated on the server; no price from the browser is accepted.
- [Critical] An order is marked paid only after the gateway confirms to your server directly, not because the browser returned to a success page.
- [Important] 3D Secure is enabled according to your gateway settings.
- [Important] Only the owner or a defined finance role can issue refunds, and each refund is logged.
- [Important] E-invoices carry the correct VAT and a QR code where required.
To go deeper, read payment security basics: 3D Secure and PCI.
Data, files and secret keys
- [Critical] Secret keys (payment gateway, messaging, AI) live in server settings, never in frontend code or the mobile app. See API keys and secrets.
- [Critical] Uploads accept only allowed formats (images, PDF) up to a size limit, and private files such as IDs and reports never open via a public link.
- [Critical] Error messages to users are general and clear; technical details go to logs only.
- [Important] Collect as little as possible: do not ask for date of birth or ID number unless you truly need it.
- [Important] Data is encrypted in transit (HTTPS) and at rest where the platform supports it.
- [Important] A clear privacy policy in Arabic and English, and a way to request account deletion.
- [As you grow] Defined retention periods: when old orders, logs and deleted-account data are removed.
Hosting, deployment and recovery
- [Critical] Every page runs over HTTPS and any http link redirects automatically.
- [Critical] Your domain registrar and email accounts use two-factor login; whoever controls the domain controls your app.
- [Important] Changes are tried in staging before production. Read staging vs production.
- [Important] Daily backups, at least one successful restore test, and you know how to roll back a bad deploy in minutes.
- [Important] Uptime monitoring that alerts you if the app goes down.
- [As you grow] In-country hosting if your sector or customers require it, and a written response plan for a data leak.
Run the checklist with the agent, step by step
- 1Ask for a report, not changes
Start with the review prompt below and ask for a table of findings before anything changes.
- 2Fix the critical items first
Request each critical fix separately and test it yourself before moving on.
- 3Re-run the two-account test
After fixes, repeat the two-account, change-the-number and visitor tests.
- 4Deploy and watch
Ship the fixes and watch logs and alerts for the first few days.
- 5Schedule the rest
Put the important and as-you-grow items in your calendar, not your memory.
Run a full security review of the app across six areas: sign-in and OTP, permissions and roles, payments, data, files and secret keys, hosting and backups, and logs. For each area show a table: item, status (met / not met / unclear), evidence (where in the code or settings), and proposed fix, sorted by severity. Focus especially on any page or data request that does not verify user ownership on the server, any price accepted from the browser, and any secret key outside the server. Do not change anything before I approve, then fix the critical items one at a time.
Try it in FanannA security routine after launch
| How often | What to do |
|---|---|
| After every major feature | Two-account test, visitor test and a permissions review of new pages |
| Weekly | Check monitoring alerts, OTP messaging costs and unusual refund requests |
| Monthly | Review staff accounts and roles, update packages and run the security review prompt |
| Quarterly | Test a backup restore, review the privacy policy and rotate important secret keys |
| Before peak seasons | Before Ramadan and White Friday: load-test checkout, review OTP limits and freeze major changes |
Security is not a wall you build once; it is a door you check is locked every night.
Key takeaways
- Start with the critical items before launch: permissions, secret keys, server-side pricing and OTP limits.
- Least privilege: every staff member and user sees only what they need.
- Never store card data in your app; let the payment gateway handle it.
- A backup you have never restored is not a backup yet.
- Security is a routine, not a one-off task: review monthly and after every major feature.
Frequently asked questions
How do I protect my app from hackers?
What are the most important security checks before launching an app?
Do I need a cybersecurity company for a small app?
How often should I run a security review on my app?
How do I protect customer data in my app?
Ask your AI assistant about this
Copy this prompt into the AI assistant you use, then add the details of your own case.
I am reading this guide: “Security checklist for AI-built apps” https://fanann.com/en/blog/security-checklist-ai-apps/ My question: security checklist for ai built apps Use that page as a source and explain the answer step by step for my situation, tell me what to check before I start, and cite the page link.