The questions to ask your AI before you launch

I'm about to launch an app I built with an AI coding tool. I want to check for exposed credentials: API keys, database credentials and service tokens that ended up in the client bundle, the repo, or the repo history. List every API key, token and secret this app uses, and say exactly where each one lives: in the client bundle, in an env file, or in the repo. Which of those can a visitor see? A good answer is a short list, each key named and placed, for example "Supabase service role key, in the client bundle, visible to anyone", with the ones that are exposed called out, and a fix for each: move it server-side, rotate it, restrict it.

Paste it into a fresh session of your AI tool, or download the prompt as a file and drop it into your agent. It carries the context, so nothing else is needed.

I'm about to launch an app I built with an AI coding tool. I want to check who can see and change what: the access rules around my data, who can read a record, who can write one, and which routes skip the check. For every table and every route: who can read it, who can write it, and what check stops a stranger? Show me the path a logged-out visitor would take to read another user's data. A good answer is table by table: the rule that guards it, and the ones with no rule named, for example "the orders table has no row-level security, so any visitor can list every order", with the rule to add, written so your AI can apply it.

Paste it into a fresh session of your AI tool, or download the prompt as a file and drop it into your agent. It carries the context, so nothing else is needed.

I'm about to launch an app I built with an AI coding tool. I want to check for things on the public internet that shouldn't be: database admin interfaces, test and debug endpoints, staging consoles, seed data, anything wired to the public that was never meant to be there. List every URL this app exposes that is not part of the product a customer uses: admin interfaces, debug endpoints, test routes, seed data. Which of those are reachable from the public internet? A good answer is the list, with the URL a stranger would use for each, for example "the database admin UI is live at /phpmyadmin", and the fix to take each one off the public internet, or put it behind authentication.

Paste it into a fresh session of your AI tool, or download the prompt as a file and drop it into your agent. It carries the context, so nothing else is needed.

I'm about to launch an app I built with an AI coding tool. I want to check for missing source control: the code has no version control, no git history, no remote backup, and the only copy is the one running in production. Where does this code live, and is there a git history and a remote backup? If I make a bad change, what is the exact step that undoes it? A good answer is the honest state, for example "the code lives only on the hosting server, there is no git history", and the setup to fix it: a repo, a remote backup, and a rollback story your AI can work within.

Paste it into a fresh session of your AI tool, or download the prompt as a file and drop it into your agent. It carries the context, so nothing else is needed.

I'm about to launch an app I built with an AI coding tool. I want to check the money paths: what a customer pays for, what a payment event unlocks, and the webhook endpoints that confirm it. Trace the payment path end to end: what does a customer pay for, what does a successful payment unlock, and how does the app verify the webhook before it acts on it? What can a stranger trigger without paying? A good answer is the path, step by step, with the weak points named, for example "the webhook endpoint trusts the payload without verifying the signature, so anyone can post a fake payment", and the check to add.

Paste it into a fresh session of your AI tool, or download the prompt as a file and drop it into your agent. It carries the context, so nothing else is needed.

I'm about to launch an app I built with an AI coding tool. I want to check the cost to run and bill shock: the three things that cost money (compute, storage, and third-party and AI API calls) and whether any of them is unbounded. What does this app pay for, per request and per month? Which routes make a paid call, and what stops a stranger from triggering it without limit? A good answer is the three drivers named with their failure mode, for example "the /generate route calls the LLM on every hit with no rate limit", and what to cap, alert on and rate-limit before launch.

Paste it into a fresh session of your AI tool, or download the prompt as a file and drop it into your agent. It carries the context, so nothing else is needed.

I'm about to launch an app I built with an AI coding tool. I want to check code health: whether the codebase is organised the way a human would organise it, naming that matches the domain, structure that matches the feature, tests that catch the regression. If a new engineer, or a new AI session, picked up this codebase tomorrow, what would they have to untangle first? Where does the naming or structure not match what the code actually does? A good answer is a short, honest list, for example "the billing logic lives in three files that don't say billing", and the clean-up that makes the next change cheaper, for a human or an AI.

Paste it into a fresh session of your AI tool, or download the prompt as a file and drop it into your agent. It carries the context, so nothing else is needed.