Jay Pozo
Download the PDFTwo pages · PDF · A4 and Letter

App launch checklist · 1 of 2

Check your app before customers use it

By Jay Pozo · Reviewed 16 October 2026

Use this checklist with the person building your app. Ask for evidence from the version you plan to launch.

Mark Pass when the evidence meets your agreed requirement. Mark Unknown when evidence is missing. Mark Needs review when a check exposes a concern.

An engineer should perform every item marked Engineer check. These checks support a launch decision; they are not a security certification.

Login and permissions

Try each account role Engineer check

Permissions are rules for what each account can do. Ask for recorded tests using a customer account and an administrator account, including direct requests to restricted actions.

Check lost and removed access Engineer check

Ask for test results covering password reset, expired login sessions and removed team members. A session is the access an app remembers after login.

Private data: who can read what

Separate customer records Engineer check

Ask for tests with two customer accounts. Show that each account can read and change only its permitted records, including through direct data requests.

Check files and shared links Engineer check

Ask for an access map for uploaded files and exports. Test private file links while signed out and while signed in as another customer.

Secret keys

Inspect what the browser receives Engineer check

A secret key grants access to a service. Ask for an engineer’s scan of browser code and code history for exposed secrets, with findings explained.

Prove keys can be replaced Engineer check

Ask for a list of key owners and a replacement procedure. Request evidence that exposed keys were revoked. Record where production keys are stored.

App launch checklist · 2 of 2

Payment paths

Test each payment outcome Engineer check

Ask for payment-provider test results covering success, failure, cancellation and refunds. Confirm amounts and access changes. Separately review the live payment configuration.

Test repeated payment messages Engineer check

A webhook is a message a service sends your app. Ask for signature checks that verify its sender. Request repeated-message and delayed-message tests. Confirm access and charges stay correct.

Backups and recovery

Restore a recent backup Engineer check

A backup is a saved copy of data. Ask for a dated restore into a separate test environment, including uploaded files. Record missing data and recovery time.

Name the recovery owner

Ask who receives failure alerts and who can restore service. Agree how much recent data loss and downtime the business can tolerate.

Expected load

Test the expected busy period Engineer check

Ask for a load test that simulates expected simultaneous customers and their main actions. Compare response times and failures with agreed targets. Record service limits.

Check running costs and limits

Ask for a cost estimate at expected use and the limits of each paid service. Record alert thresholds and the person responsible for responding.

Release and rollback

Rehearse the release Engineer check

A release puts a version in front of customers. Ask for a checklist naming the exact version. Request configuration checks and tests after release.

Rehearse returning to a working version Engineer check

A rollback restores an earlier version. Ask for a rehearsal and a plan for database changes, which may need separate recovery. Record who makes the decision.

Record each unknown or concern with an owner and a due date. Review the remaining risks with an engineer before deciding to launch.

Official references

Use the documentation for your app’s actual tools. These examples explain checks an engineer may use. Links reviewed 16 October 2026.

Email me when the next checklist is ready

The downloads are yours to keep. This optional signup sends your details to me for future follow-up.

Check the box to request follow-up. I receive your email address and the checklist you chose.

Get a second opinion on the evidence

Book a call