The checklist I ran iiCaptain through

On social media you keep running into them: lists of what can go wrong in apps you build with AI. Keys that are out in the open, or a database anyone can get into. I collected the points from those posts and put them in one list of 21.

Then I ran iiCaptain through it. I gave the list to Claude with this question:

Can you check my app on all these points and create a markdown file to plan out how to address these points. No changes to the code yet pls

A plan first

That last sentence matters. You get an overview first, and then you decide what happens when. The AI reads your code and writes down for each point whether it’s fine, partly done or missing, with the file name and line number. Then it puts the work in order: what has to happen this week, what within a month and what can wait.

Only when that plan is right do you let it make changes. Point by point, with a test for every change.

The 21 points

This is the list, in plain words. Feel free to use it.

1. Protect your API keys. A key that’s visible in the browser should be limited to your domain and to the services you actually use.
2. Keep .env files out of git, in subfolders too, such as your mobile app’s.
3. Never put a secret in the code itself.
4. Build real authentication, and check on the server who’s logged in.
5. Check permissions on the server, never only in the app.
6. Don’t trust a user ID that comes from the browser. Take it from the verified token.
7. Keep the data of users and teams apart, and test that a member of team A can’t get into team B.
8. Lock down your database: whatever isn’t explicitly allowed is forbidden.
9. Look at your backend’s storage too, such as Firebase or Supabase, not just the database.
10. Protect admin pages on the server.
11. Turn off debug mode in production.
12. Don’t show users technical error messages.
13. Validate all input on the server.
14. Make what users enter harmless before you show or send it. In emails too.
15. Secure uploads: type, size and number, checked on the server.
16. Prevent SQL and NoSQL injection.
17. Limit the number of attempts at login and signup.
18. Search your git history for secrets that were ever in it.
19. Set security headers.
20. Allow CORS only where it’s needed.
21. Ask your AI for a security review, and repeat it.

Let your AI check and fix

You can hand this list straight to Claude or ChatGPT. Have it go through your code point by point, and then fix what’s missing. For example:

Check this app against the 21 points below. For each point,
write in a markdown file: fine, partly or missing, with the
file and line, and what needs to happen. Mark separately what
can only be checked in a console. Don't change anything yet.

[paste the list here]

If the plan is right, ask it to carry it out phase by phase.

Beyond your code

Part of the list isn’t in your code. It’s about settings in the services your app depends on: the keys in Google Cloud, the rules in Firebase or Supabase, the previews in Vercel, branch protection in GitHub. An AI that only reads your code can’t see those.

That’s where a browser extension helps. With the Chrome extension of Claude or ChatGPT, the AI can look along in your browser through computer use, where you’re already logged in to those services. That way it can check those settings too and change them where needed. This is production, though. Let it look and report first, and approve every change yourself.

Two points I add

22. Have your AI look for code your app doesn’t need: files nobody uses, packages that are never imported, code that’s almost the same four times over. Have it double-check every finding before it removes anything. I did that for iiCaptain with a skill called ‘ponytail’.
23. Check that your tests and checks actually run. A green tick doesn’t always mean anything was tested.

Repeat the check every quarter and before every major release.