Before publishing any website or app built with the help of AI, there’s a short list of things worth checking. You don’t need to be a developer to understand what each point is asking —what you do need is someone to actually check them before launch, not after something breaks.
Before you publish: the ten-minute check that prevents the most common problem
Explicitly ask someone to check whether there are keys, passwords or credentials visible in the code the page loads —the database key, the payment gateway key, any connected service’s key. It’s the most common flaw and the easiest to check for: open the source code the browser sees and look for anything that looks like an access key. If something shows up there, it shouldn’t be.
Check who can get in where they shouldn’t
Any private area —admin panel, order management, registered user section— needs to require a username and password before showing anything, not just hide the link. Try typing the URL of those areas directly without logging in: if you get in anyway, there’s a problem. And “nobody knows that URL” doesn’t count as protection: if it exists, someone can find it, whether by searching or by trying common URLs.
Test the forms like someone with bad intentions would
On every form —contact, signup, search, comments— enter something other than the expected data type: text where a number is expected, odd symbols where a name is expected, a very long text where a short phrase is expected. A well-built form rejects or cleans up that data without breaking. A poorly built one accepts and stores it as-is, which opens the door for someone to insert something malicious later on.
Confirm there’s a backup, and that it genuinely works
It’s not enough for a backup to exist, it needs to be confirmed that it can actually be restored from. Many projects discover their backup had been silently failing for months on the exact day they need it. A real test —restoring the backup into a test environment, even just once— is worth more than trusting it “should be working.”
And if none of this sounds familiar, get help before you publish
This list covers the basics, it doesn’t replace a full technical review. If you built your project with the help of artificial intelligence and none of these four points sound familiar, it’s faster and cheaper to have someone review it before publishing than to fix it after a problem hits. Our maintenance and review service covers exactly this kind of check. If you’d like us to take a look before it goes live: tell us about your project.
Frequently asked questions
Can I do this review myself without technical knowledge?
The first two points —looking for visible keys and testing access to private areas— can be attempted by anyone with some patience, though without a guarantee of catching everything. Forms and backups already require more technical judgement to interpret the result properly, so it’s worth having someone experienced review those.
How long does this review take before publishing?
For a small project, a basic review of these points takes anywhere from a couple of hours to a day, depending on complexity. That’s time you get back many times over compared to what handling a data leak costs after publishing without a review.
Does this checklist also apply to websites that have been live for a while?
Yes, it works just as well as a later review, not only before launch. In fact, it’s worth repeating periodically, not just once, because dependencies and configuration change over time even if the rest of the site stays untouched.