Back to blog
Founder Guides4 min readMar 1, 2026, 12:00 AM
Pre-launch security checklist for indie apps
Fifteen minutes before you post on Product Hunt: domain, TLS, headers, forms, and the scans worth running.
By VibeScan Team
Launch day adrenaline is real. This checklist is for the hour before you share the link.
Domain & DNS
- Custom domain points to production, not staging
- DNS records include valid SPF/DMARC if you send email
- No surprise subdomains (
dev.,old.,test.)
HTTPS & certificates
- Valid certificate on apex and
www - HTTP redirects to HTTPS
- No mixed-content warnings in browser devtools
Secrets & exposure
- No
.env,.git, or backup files publicly reachable - Admin panels not indexed or open without auth
- API keys not in frontend JavaScript
App surface
- Login, signup, and password reset on HTTPS
- Forms don't echo unsanitized input
- CORS not set to
*on authenticated APIs
CMS-specific (if applicable)
- Default admin URL restricted or protected
- Plugins/themes updated
- File upload directories not listing contents
Run VibeScan
Paste your production URL. Wait for the scan. Fix Critical and High first. Ship anyway if only Low informational items remain—but schedule fixes.
Security isn't the enemy of speed. Unplanned downtime from a preventable misconfiguration is.
Put the guide into practice
Run a VibeScan on your site and see which checks pass—and which ones need your attention.