The Security Prompt Checklist I Run Before Every Launch

Try to get into an account that isn't mine. Look for: signup flows that let you claim someone else's email, password reset flows that leak whether an email exists, session tokens that don't actually expire, and any way to access a page meant for a logged-in user without being logged in. List every path you find, ranked by how bad it is.

Try to get paid access without paying, or pay less than the actual price. Check the checkout flow for client-side price manipulation, coupon logic that can be abused, and any state where a user can flip themselves to "subscribed" without a successful payment actually completing.

Look at how sessions and cookies are created, signed, and verified. Can any value be forged or replayed? Can a cookie from one account be reused to access another? Is anything about identity trusted from the client that should be verified server-side instead?

For every place this app reads or writes user data, check whether a user could access, modify, or delete another user's data by changing an ID in a request. This is the single most common real-world vulnerability in apps like this — check it exhaustively, not just on the obvious endpoints.

What stops someone from hitting this app's expensive endpoints (search, AI calls, email sends) thousands of times in a minute? What's the actual cost to me if someone does that right now?