What to review before a product launch

Launch pressure tends to push security to the end of the list, right when the cost of finding a serious issue late is highest. A short, focused review before launch is usually far cheaper than fixing the same issue after customers are on the platform.

Authentication and session handling

Password reset flows, session expiry, multi-factor enforcement and account lockout are worth checking specifically, because they are frequently built early, rarely revisited, and directly protect every user account on the platform.

Authorisation between accounts

In a multi-tenant or multi-user product, the highest-impact bugs are almost always about one account reaching another account's data — not exotic exploits. This is the single most valuable thing to test before real customers are relying on the separation being correct.

Secrets and configuration

API keys, database credentials and signing secrets should never be reachable from client-side code, public repositories or verbose error messages. A quick check of what the application exposes in responses and source maps catches this class of issue early.

Logging and visibility

If something does go wrong after launch, the team needs to be able to see it. Confirming that authentication events, admin actions and failed authorisation attempts are actually logged is a cheap step that pays off the first time something unusual happens in production.