Pre-launch Security Audit

Establish a practical launch baseline without presenting a quick review as a penetration test, legal opinion, or compliance certification.

Set scope

1. Identify entry points, trust boundaries, identities, privileged operations, sensitive data, paid resources, deployment environments, and third-party services.
2. Inspect the repository and configuration before making claims. Distinguish confirmed findings from unverified assumptions.
3. Ask only for information that cannot be inferred safely, such as the production architecture or authorization to test a live system.
4. Keep active testing within systems the user owns or has explicitly authorized. Prefer local, staging, and non-destructive tests.
5. Treat health, financial, biometric, children's, government, and similarly regulated data as requiring specialist review.

Run the audit

Use references/checklist.md as the control set. Adapt controls to the stack; do not prescribe a named vendor when an equivalent control already exists.

1. Map exposure

Trace browser/mobile code, server routes, database access, object storage, background jobs, webhooks, logs, analytics, and external APIs. Record which code runs in an untrusted client and which credentials or permissions each component receives.