Contact

Pre-launch security checklist: what to test before real users and real money arrive

Before launch, prove five things: no user can reach another user's data, no secret ships inside your app or web bundle, every payment and webhook is verified on the server, your dependencies carry no known critical flaws, and your logs are good enough to investigate an incident. In India, CERT-In's directions of 28 April 2022 also require listed cyber incidents to be reported within 6 hours and logs to be kept for 180 days. Use the OWASP Top 10:2025 as the map and OWASP ASVS 5.0 Level 2 as the bar most applications should aim for. Official sources checked on 20 October 2026; this is not a penetration test, and the CERT-In items are a planning summary, not legal advice.

20 items in 6 groups · rules checked against the official pages on 20 October 2026

Not legal advice. This page explains official rules in plain words for people building apps. Rules and store policies change: check the linked primary sources, and ask a qualified lawyer before you act on anything with legal consequences.

1 Access control

  • Call every route as a second user with the first user's record IDs, and as a signed-out visitor; every call that should fail must fail.

    Broken access control is A01 in the OWASP Top 10:2025.

    Official source

  • Make every admin route declare the permission it needs, and refuse access when a route has none declared.

    A route that fails open when someone forgets a check is the most common way admin data leaks.

  • Require two-factor sign-in for every staff account, and let support screens show only the fields support needs.

    Staff accounts can see everyone's data, so they are what an attacker goes after first.

2 Secrets and configuration

  • Search the built web bundle and the built app (APK, AAB or IPA) for API keys, secret keys and development hostnames before release.

    Anything in a client bundle can be read by anyone who installs the app or opens the site. Stripe's go-live checklist says your code must not include API keys.

    Official source

  • Check the shape of every key before a build: a secret key pasted into a public key's field looks the same to the build tool.

    The build succeeds either way, and the mistake ships to every user.

  • Encrypt third-party credentials you store for customers, with the key kept outside the database.

    Cryptographic failures are A04 in the OWASP Top 10:2025; a database dump should not hand over your customers' other accounts.

    Official source

  • Turn off debug output and stack traces in production responses and release builds.

    Security misconfiguration is A02 in the OWASP Top 10:2025, and stack traces map your code for an attacker.

    Official source

3 Payments and integrity

  • Verify the signature on every payment webhook before acting on it.

    Stripe and Razorpay both sign webhook events and tell you to verify them; an unverified endpoint accepts forged payments.

    Official source

  • Read prices, plans and amounts from your server or the gateway's order, never from the client's request.

    Software and data integrity failures are A08 in the OWASP Top 10:2025; a phone app's request is whatever the user makes it.

    Official source

4 Sign-in and passwords

  • Require passwords of at least 15 characters where the password alone signs a user in (at least 8 when it is one factor of several), allow at least 64, and check new passwords against a list of breached and common passwords.

    NIST SP 800-63B-4, final since July 2025. Have I Been Pwned's Pwned Passwords API offers a free breached-password check.

    Official source

  • Drop character-mix rules and forced periodic password changes.

    NIST SP 800-63B-4 says verifiers shall not impose composition rules or require periodic changes.

    Official source

  • Rate-limit sign-in, one-time codes and password resets, and stop accepting a code after a few wrong tries.

    Authentication failures are A07 in the OWASP Top 10:2025.

    Official source

5 Dependencies and untrusted input

  • Run a dependency audit and fix every critical and high finding by upgrading, replacing or removing the package, not by suppressing it; date the result.

    Software supply chain failures are A03 in the OWASP Top 10:2025, and an audit result is true only on the day it was run.

    Official source

  • Treat text from users, uploaded files and AI models as untrusted data: parameterise queries, never evaluate it as code, and never let model output decide permissions.

    Injection is A05 in the OWASP Top 10:2025; text an AI model reads from an image or a document can carry instructions.

    Official source

  • For mobile apps, check the build against the OWASP Mobile Application Security Verification Standard (MASVS).

    MASVS v2.1.0 is OWASP's current standard for mobile app security and privacy.

    Official source

6 Logs and incidents

  • Log sign-ins, failed access, admin actions and payment changes, and make the admin audit log tamper-evident.

    Security logging and alerting failures are A09 in the OWASP Top 10:2025; without logs you cannot say what happened.

    Official source

  • If you operate in India, be ready to report the incident types CERT-In lists within 6 hours of noticing them.

    CERT-In's directions of 28 April 2022 apply to service providers, intermediaries, data centres, body corporates and government organisations; Annexure I lists 20 incident types, including data breaches, data leaks and attacks on applications.

    Official source

  • Keep logs of all ICT systems for a rolling 180 days, and sync server clocks to NIC or NPL time servers or servers traceable to them.

    Required by the same directions. CERT-In's FAQ says the logs may be stored outside India as long as they can be produced to CERT-In in reasonable time.

    Official source

  • Make failure paths safe: back off on repeated failures, and fail closed when a dependency is down.

    Mishandling of exceptional conditions is A10 in the OWASP Top 10:2025.

    Official source

  • Write down who decides, who fixes and who tells users when there is an incident, before you need it.

    India's DPDP Rules will also require breach notices to users and the Data Protection Board eighteen months after their publication, 13 May 2027 by our count; see the DPDP checklist.

    Official source

What did these checks catch in our own builds?

Trainr

Checking the shape of every key before the live-payments build caught a Stripe secret key pasted into the Google Places key field; shipped, it would have been readable in every installed copy of the app. We also searched the built JavaScript bundle to confirm the new error-monitoring DSN appeared once and the old one nowhere.

Pakka

A probe of the money routes before the 31 August 2026 production deploy found two confirm endpoints that trusted figures sent by the phone; both now read the plan, the driver and the amount from the Razorpay order. Pickup and drop codes stop working after five wrong tries.

Flying Pup Films

npm audit reported 38 vulnerabilities on the backend on 16 June 2026 (1 critical, 11 high); each was closed by upgrading, replacing or removing a package, none suppressed, and the audit read 0 that day with the 1,071-line integration suite still passing.

LeafRanger

Every admin console route is gated by a role permission and fails closed.

Temphera

Nine staff roles, each requiring 2FA; admin reads pass a per-collection field allowlist, and a unit test fails if a content field appears in one; the admin audit log is hash-chained. Temphera is built but not released, so these are verified in tests, not in production.

Storafleet

Customers' cloud credentials are stored with AES-256-GCM, and AWS buckets can be connected through an IAM role that Storafleet can assume only with a per-connection ExternalId, so no keys leave the customer's account.

AskForth

The form renderer evaluates conditions and calculations with its own small expression parser, never eval, so embedded forms work under strict Content Security Policies.

Questions about this checklist

What is the OWASP Top 10:2025, and what is first on it?

OWASP's list of the most critical security risks to web applications; the 2025 edition is the current release. Broken access control is first, followed by security misconfiguration and software supply chain failures.

What password length does NIST recommend in its 2025 guidance?

At least 15 characters when a password is the only factor, and at least 8 when it is used with another factor, under NIST SP 800-63B-4 (final, July 2025). It also says to allow at least 64 characters and to check new passwords against breached and common ones.

How quickly must an Indian company report a cyber incident to CERT-In?

Within 6 hours of noticing it, for the 20 incident types listed in Annexure I of CERT-In's directions of 28 April 2022, which cover body corporates as well as service providers, intermediaries and data centres.

Do CERT-In's rules require logs to be stored in India?

The directions require logs of all ICT systems to be kept for a rolling 180 days within Indian jurisdiction, but CERT-In's own FAQ of May 2022 says logs may be stored outside India as long as they can be produced to CERT-In in reasonable time.

Is this checklist a substitute for a penetration test?

No. It covers what a build team should prove before launch. A formal penetration test with a certificate is a specialist's job, separate from this checklist and from our code audit.

Which OWASP ASVS level should a startup's web app aim for?

Level 2. OWASP's Application Security Verification Standard 5.0 says most applications should be striving for it; Level 1 is the minimum first layer and Level 3 is for applications that must show the highest assurance.

Sources (12)

Keep reading

Other checklists

All 7 checklists