20 Things to Have Claude Do Before Launching Your App

Shipping an app is exciting — but a rushed launch can expose you to security holes, broken UX, and preventable bugs. Before you hit “deploy,” run through this checklist with Claude to catch the issues that are easy to miss under deadline pressure.

Here are 20 things you should have Claude check, fix, or implement before your app goes live.

🔐 Security & Secrets

1. Hide API keys – Move all keys out of client-side code and into environment variables or a secrets manager.
2. Purge Git secrets – Scan your commit history for leaked credentials and scrub them from the repo.
3. Use public DB keys correctly – Make sure only intentionally public keys are exposed; anything sensitive stays server-side.
4. Enable row-level security – Lock down your database so users can only access rows they’re authorized to see.
5. Encrypt sensitive data – Protect PII and other sensitive fields at rest and in transit.
6. Enforce server-side auth – Never trust client-side checks alone; validate every request on the server.
7. Lock record access – Add ownership checks so users can’t read or edit records that aren’t theirs.
8. Block field tampering – Prevent users from modifying fields (like role or price) they shouldn’t be able to touch.
9. Secure session cookies – Set HttpOnly, Secure, and SameSite flags to reduce session hijacking risk.
10. Hash passwords – Never store plaintext passwords; use a strong, salted hashing algorithm like bcrypt or Argon2.

🛡️ App Hardening

11. Rate limit login – Throttle login attempts to prevent brute-force attacks.
12. Add bot protection – Use CAPTCHAs or similar tools on forms vulnerable to spam and abuse.
13. Parameterize queries – Eliminate SQL injection risk by never concatenating raw user input into queries.
14. Validate all input – Check type, format, and range on every input, client and server side.
15. Escape user content – Sanitize anything rendered back to users to prevent XSS attacks.
16. Restrict file uploads – Limit file types, sizes, and scan uploads before storing or serving them.
17. Trim API responses – Only return the fields the client actually needs — don’t leak internal data.
18. Add security headers – Set headers like CSP, X-Frame-Options, and HSTS to harden your app.
19. Force HTTPS – Redirect all traffic to HTTPS and disable insecure connections.
20. Scan dependencies – Run a vulnerability scan on your packages before shipping.

Final Thoughts

None of these steps take long individually, but skipping even a few can leave your app exposed on day one. Before your next launch, paste this list into a conversation with Claude and have it walk through your codebase item by item — it’s a fast, low-effort way to catch the mistakes that are easiest to overlook.

Did we miss anything? Drop your must-do pre-launch checks in the comments.