Skip to main content
NinjaNext

Free, instant, nothing stored

Is your AI-built app ready for real users?

Eight questions, in the order we would ask them. They are the same checks our free first look starts with, and every one can be answered today without a developer.

0 of 8 answered

  1. 1. Have you checked that one signed-in customer cannot read another customer's data?

    Make two accounts, then from the second try to open something belonging to the first by changing the identifier in the address.

  2. 2. Are you confident no secret key has shipped inside the files a browser downloads?

    Build tools copy configuration into the bundle, so a key can be absent from your source and public anyway. The version history counts too.

  3. 3. If you take payments, is an order confirmed by the payment provider rather than by the browser?

    Answer yes if you take no payments at all. Otherwise, the confirmation has to reach your own server, and arriving twice must not charge twice.

  4. 4. Are the repository, domain and database all under accounts your company controls?

    Personal accounts and a card in somebody's own name are the two that cause lasting damage.

  5. 5. Does the project build and run from the repository alone, on a clean machine?

    If it only runs where it was built, you do not yet have a handover, whatever was agreed.

  6. 6. Is there an automated test around the flows that matter most, such as signing in or paying?

    Not full coverage. One test on the flow that must never break is the one that pays for itself.

  7. 7. Do backups exist, and has a restore actually been performed?

    An untested backup is a belief rather than a backup. The test is whether anyone has restored one.

  8. 8. Can your public pages be read without running JavaScript?

    View the page source of a public page. If the content is not in it, search engines and assistants may not see it either.

Answer every question to see the result. “Not sure” is a valid answer and counts the same as no, because each of these can be settled in an afternoon.

What this is, and what it is not

This is a self-assessment: it reports what your own answers imply, and nothing more. It does not inspect your code, it cannot see your app, and it is not a security audit or a compliance check. Your answers stay in this browser tab, are not sent anywhere and disappear when you close it.

Let's build it

Want someone to actually look?

The first look is free and takes a few days. You get the findings and a plan, whether or not you go further with us.

Send us your appHow the rescue works