This article breaks down a quick, five-step security routine you run before every app launch—from legal basics and database lockdown to auth failure tests, AI-driven audits, and infrastructure protections. Spend 30 minutes on these checks to avoid data leaks, runaway bills, and legal headaches when real users arrive.

• A 30-minute pre-launch checklist (legal, database, auth, AI audit) can prevent the data leaks, runaway bills, and legal threats hitting unprepared indie app launches.
• Missing Row Level Security policies in Supabase means anyone with browser DevTools can dump entire database tables.
• Four simple auth failure tests (wrong passwords, reset on fake email, double-clicked verify links, duplicate email signup) catch about 80% of authentication vulnerabilities.
• Running four targeted prompts through Claude Code or Cursor (security headers, OWASP check, data-leak audit, API-key exposure) takes about 8 minutes and can catch exposed .env values and leaked API keys before they drain a project.