This page joins the checklist from the end of every stage. Each item is one action and the source it rests on. Ticks stay in this browser only, and they match the ticks on the stage pages. The tags say how often the item applies: Must do for almost every app, Should do for most apps, and If it applies when it depends on what your app does.
Turn on Row Level Security for every table in every exposed schema, then write a policy for each action the app needs. Must do Source: Supabase RLS guide , Postgres row security Test as a stranger: with only the public key and no login, try to read and write every table. Must do Source: Palmer on CVE-2025-48757 , Wiz on Moltbook Test as the wrong user: sign in as one user and request another user's records by changing IDs. Must do Source: OWASP A01:2025 , Wiz on Base44 Read every policy your agent wrote, and replace any rule that only checks for a login with one that checks ownership. Must do Source: Firebase insecure rules , OWASP Authorization Cheat Sheet On Supabase, revoke the default anon and authenticated grants on tables that should not be public, and grant only what the app needs, before the 2026-10-30 change. If it applies Source: Supabase changelog , Supabase RLS guide On Firebase, replace Test mode rules before launch. If it applies Source: Firebase insecure rules Keep the secret or service_role key on the server; only the publishable or anon key may appear in browser or app code. Must do Source: Supabase API keys Check that no NEXT_PUBLIC_ or VITE_ variable holds a secret, then search the built output for secret key prefixes. Must do Source: Next.js environment variables , Vite env variables Turn on GitHub secret scanning and push protection; if a secret reaches git, rotate it first, then clean up. Should do Source: GitHub push protection , OWASP Secrets Management Write a one-page breach plan: who decides, how you reach users, and which deadlines apply where your users are. Must do Source: GDPR Art. 33 , California SB 446 digest , Washington RCW 19.255.010 , 50-state survey Rate limit login, password reset and one-time code endpoints, and send basic security headers. Should do Source: OWASP Authentication Cheat Sheet , OWASP Secure Headers , Supabase rate limits Do not treat your platform's built-in security scan as your security review. Should do Source: Lovable security docs Make a list of every third-party script, font, SDK and vendor your app loads, on every page and screen, with the personal data each one receives. Must do Source: GDPR Art. 28 , OWASP Top 10:2025 Remove each script or SDK on that list that you cannot give a clear reason for. Should do Source: Munich Regional Court, 3 O 17493/20 Self-host your web fonts instead of loading them from Google's servers, especially if you have visitors in the EU. Should do Source: Munich Regional Court, 3 O 17493/20 Sign or accept the data processing agreement of every vendor that handles your users' personal data, if the GDPR applies to you. If it applies Source: GDPR Art. 28 Publish a list of your subprocessors and say how people can learn about changes to it. Should do Source: GDPR Art. 28 Check the license of every dependency, keep the MIT and similar notices, and keep GPL and AGPL code out of a closed product unless you have decided to comply. Must do Source: MIT license , GPL FAQ , AGPL v3 Commit your lockfile and install pinned versions, not whatever is newest. Should do Source: CISA alert on npm Run npm audit or OSV-Scanner on every build and make a high-severity finding stop the build. Should do Source: npm audit , OSV-Scanner Turn on Dependabot alerts for your repository. Should do Source: GitHub Dependabot alerts Before you accept a change from your agent, check that every new package it added exists and is the real one you meant. Must do Source: arXiv 2406.10279 When a supply-chain attack hits a package you use, rotate your GitHub, npm and cloud credentials. If it applies Source: CISA alert on npm , GitHub npm security plan Update the vendor list and your public subprocessor list every time you or your agent add a script, SDK or service. Should do Source: GDPR Art. 28 Write a data inventory from your real code: every field, SDK, analytics tool, AI provider and log, where each one sends data, and for how long you keep it. Must do Source: Apple App Review Guidelines 5.1.1 , GDPR Art. 13 Start from a template, then edit it to match what your app really does. Should do Source: General Legal templates (CC0) , Basecamp policies Make sure your privacy policy covers the six CalOPPA items: PII and third-party categories, how a user can review and request changes to their own PII if you offer that, how you announce changes, the effective date, your Do Not Track answer, and whether third parties may track users over time and across sites. Must do Source: Cal. Bus. & Prof. Code Sec. 22575 If people in the EU can use your app, add the GDPR Article 13 items: who you are, purposes and legal basis, recipients, transfers, retention, rights, and the right to complain. If it applies Source: GDPR Art. 13 , GDPR Art. 3 Read the finished policy against your inventory and delete or fix every promise the app does not keep. Must do Source: FTC on OkCupid , Cal. Bus. & Prof. Code Sec. 22576 Post the privacy policy as a public web page, not a PDF, and link it from your app and your store listing. Must do Source: Cal. Bus. & Prof. Code Sec. 22575 , Google Play User Data policy If you use Google sign-in or list on Google Play, host the policy on your own domain and link it from the OAuth consent screen. If it applies Source: Google OAuth verification , Google Play User Data policy Show your terms at sign-up with an unticked "I agree" box or a button that says it means agreement, with the terms linked next to it, and save who agreed to which version. Should do Source: Nguyen v. Barnes and Noble , Berman v. Freedom Financial Put a cookie notice on your site that lists each cookie or similar storage and why, and get consent first for anything not strictly necessary if you have EU visitors. If it applies Source: ePrivacy Directive Art. 5 If users can create an account, let them delete it inside the app, and on Google Play also give a web link for deletion. If it applies Source: Apple account deletion , Google Play account deletion Fill in Apple's App Privacy answers and Google Play's Data safety form, including your SDKs, and redo them when your data use changes. If it applies Source: Apple App Privacy details , Google Play Data safety If you offer Google sign-in, put a homepage that describes the app on your own verified domain and get OAuth verification, because an unverified app is capped at 100 new users in total. If it applies Source: Google OAuth verification , Google unverified apps If you take payments with Stripe, show what you sell, the currency, contact details beyond a form, your refund and cancellation policy, your privacy policy and your business address. If it applies Source: Stripe website checklist Update the policy and its effective date every time you add a vendor, SDK, analytics tool or AI provider. Must do Source: Cal. Bus. & Prof. Code Sec. 22575 Check once a year whether you now pass the CCPA tests or another state's privacy law threshold. Should do Source: CPPA thresholds , IAPP state tracker Keep a one-page list of every tracker on your site and app: what it is for, what data it sends, whether it waits for consent, and whether you have a contract with the vendor. Must do Source: CPPA on Tractor Supply , CPPA on Honda For visitors in the EU, load no analytics, replay, ad pixel or chat widget that stores or reads data on their device until they accept. If it applies Source: EDPB Guidelines 2/2023 , PostHog data collection Put a Reject button on the same layer as Accept, with the same size and style. If it applies Source: EDPB cookie banner report , CNIL on Google, 2025 If you have a banner or an opt-out, test that Reject really stops tracking: click Reject, reload, and check the Network and Cookies tabs in your browser's developer tools. If it applies Source: California AG on Healthline Turn session replay off in your code, not only in the vendor dashboard, until you have a reason and a consent step. Should do Source: PostHog config , PostHog replay controls If you record sessions, show notice and get consent before recording starts. If it applies Source: DLA Piper on Javier If you record sessions, mask all inputs and sensitive text, block payment, login, settings and chat pages, and scrub network request bodies. If it applies Source: PostHog replay privacy , Clarity masking Turn off autocapture and send only the named events you chose. Should do Source: PostHog data collection If the CCPA covers you and you sell or share data, honor Global Privacy Control as an opt-out and apply it to the whole logged-in account. If it applies Source: 11 CCR 7025 , California AG on Sephora , California AG on Disney Do not ask for ID just to opt out, and test your opt-out form after every deploy. If it applies Source: CPPA on Todd Snyder , CPPA on Honda If you use Microsoft Clarity and have visitors from the EEA, the UK or Switzerland, send the consent signal through its Consent API or a supported consent tool. If it applies Source: Clarity consent mode Do not treat SB 690 as permission for session replay or chat recording; get consent before any tool captures what users type. Should do Source: Baker Donelson on SB 690 , WilmerHale on SB 690 Write down whether your app collects any health information, including symptoms, medications, fertility, mood or mental health, and keep the answer with your other launch notes. Must do Source: FTC Health Breach Notification Rule , FTC on GoodRx Remove ad pixels and ad SDKs from every screen and page where users enter or read health information. If it applies Source: FTC on GoodRx , FTC on BetterHelp Rename the events, page titles and URLs you send to analytics and ad tools so that none of them names a condition, a drug or a diagnosis. If it applies Source: California AG on Healthline , FTC on GoodRx Never upload emails, phone numbers or ad IDs from a health app to an ad platform for targeting. If it applies Source: FTC on GoodRx , FTC on BetterHelp Check that your privacy policy names every place health data goes, and that the app does exactly what the policy says. If it applies Source: FTC Flo Health case , FTC on BetterHelp Add health data to your breach plan, and treat data sent to a third party without permission as a breach that needs notices. If it applies Source: FTC Health Breach Notification Rule , Federal Register, 2024 amendments Do not let a third-party SDK or recording tool capture health entries or private messages, because California's recording law needs every party's consent. If it applies Source: Meta 10-Q on the Flo verdict , Penal Code 637.2 (mirror) If you have users in Washington and handle anything that could reveal health, have a lawyer check your app against the My Health My Data Act. If it applies Source: RCW 19.373.090 , Orrick on the first lawsuit Write down who your app is for, and if it is for a general audience, do not market it to children under 13. Must do Source: FTC COPPA compliance plan , FTC COPPA FAQ When you learn that a user is under 13, for example from a parent's email, get a parent's consent or delete that user's data, and log what you did. Must do Source: FTC COPPA FAQ If you ask for age, use a neutral age gate: empty birth date fields, no default, no "over 12" checkbox, and a cookie so the answer cannot be changed. If it applies Source: FTC COPPA FAQ If your app is directed to children, get verifiable parental consent before you collect personal information, and separate consent before you share it with third parties. If it applies Source: FTC COPPA compliance plan , Federal Register, 2025 COPPA Rule Get verifiable parental consent before analytics or ad SDKs collect persistent identifiers in any part aimed at children, and remove them if you list in the App Store Kids Category. If it applies Source: eCFR 16 CFR 312.2 , Apple guideline 1.3 (Kids Category) If children use your app, write a security program and a retention policy, and delete children's data when you no longer need it. If it applies Source: Federal Register, 2025 COPPA Rule , FTC announcement Before you ship a mobile app to users in Texas or Utah, check the current state of their app-store age laws. If it applies Source: InfoLawGroup on Texas , Loeb and Loeb on Utah Pick WCAG 2.2 level AA as your target and write it in your project notes so your agent builds to it. Must do Source: WCAG 2.2 , WCAG 2.1 Give every meaningful image and icon button a text alternative, and mark decorative images so screen readers skip them. Must do Source: WCAG 2.2 quick reference Give every form field a visible label that stays when the user types, not only a placeholder. Must do Source: WCAG 2.2 quick reference Make every task work with a keyboard alone, with a visible focus outline that sticky headers and popups do not cover. Must do Source: WCAG 2.2 , WCAG 2.2 quick reference Check text contrast and fix anything below 4.5:1 for normal text or 3:1 for large text. Must do Source: WCAG 2.2 quick reference Check your app against the six rules WCAG 2.2 added: focus not obscured, dragging, target size, consistent help, redundant entry and accessible login. Should do Source: WCAG 2.2 Run axe, WAVE or Lighthouse on every key page and fix what they report. Must do Source: axe DevTools , WAVE , Lighthouse Do a keyboard-only pass and a screen reader pass through sign-up, login and your main task, because automated tools miss many problems. Must do Source: WCAG 2.2 quick reference , WAVE Publish an accessibility statement with your target standard, known gaps and a way to report problems. Should do Source: Seyfarth Shaw on 2025 filings If you sell a covered consumer service to EU buyers, check whether you are above the microenterprise limits, and if so meet the European Accessibility Act. If it applies Source: Directive 2019/882 Article 4 , Article 3 definitions , European Commission If you sell to schools, cities or other public bodies in the US, be ready to show WCAG 2.1 AA conformance before their 2027 and 2028 deadlines. If it applies Source: ADA.gov web rule first steps Add an automated accessibility check to your tests so new pages do not slip back. Should do Source: axe DevTools , Lighthouse Write down which kinds of AI feature your app has: chat, companion, generator, decision tool, or data sent to an AI company. Must do Source: EU AI Act Article 50 (mirror) , California SB 243 text , Colorado SB 26-189 Show a plain "you are chatting with an AI, not a person" notice at the start of every chat session. Must do Source: EU AI Act Article 50 (mirror) , Utah SB 226 , Anthropic Usage Policy Never give a bot a human name or photo without an AI label, and never let it deny being an AI when asked. Must do Source: Utah SB 226 , BOT Act summary If your app is on the App Store, name the outside AI company and get explicit permission with a clear button before you send it user data. If it applies Source: Apple App Review Guidelines 5.1.2(i) If your app generates images, audio, video or text, ask your model vendor in writing how outputs are marked, and check your app does not strip the mark. If it applies Source: Cuatrecasas on the Omnibus dates , EU AI Act Article 50 (mirror) If you publish deepfakes or AI-written public-interest text, label them as AI-made. If it applies Source: EU AI Act Article 50 (mirror) If your bot is a companion chatbot with California users, add the AI notice, a published self-harm protocol with a crisis-line referral, the minors notice, and three-hour break reminders for known minors. If it applies Source: California SB 243 text If your bot is support or productivity only, write one paragraph on why it is not a companion chatbot and keep it with your launch notes. Should do Source: California SB 243 text Remove any AI claim from your site and app store page that you cannot prove with a test you kept. Must do Source: FTC Operation AI Comply Read the usage policy of every AI model provider you use on launch day, and note its rules on advice, high-risk uses and minors. Must do Source: Anthropic Usage Policy , OpenAI usage policies If your AI helps decide hiring, lending, housing, insurance, health care, education or benefits, plan Colorado notices and documentation for 2027. If it applies Source: Colorado SB 26-189 If you work in a licensed field in Utah and your AI collects health, financial or biometric data or gives advice, disclose the AI before the chat starts. If it applies Source: Utah SB 226 Write down whether your app hosts user content, and which future feature would change that answer. Must do Source: 17 U.S.C. 512 , TAKE IT DOWN Act text If users can upload or post, register a DMCA designated agent online with the Copyright Office for $6. If it applies Source: DMCA Designated Agent Directory , Copyright Office fees Put the same agent contact details on a copyright page on your website, linked from your terms. If it applies Source: 17 U.S.C. 512 , Copyright Office FAQ Add calendar reminders to renew the agent designation before it expires three years after you register it. If it applies Source: 37 CFR 201.38 , Copyright Office FAQ Write a takedown procedure and a repeat infringer policy, tell users about the policy in your terms, and follow both. If it applies Source: 17 U.S.C. 512 Do not rely on Section 230 for copyright claims; use the DMCA process for those. If it applies Source: 47 U.S.C. 230 If users can post images or video others see, build a removal process for non-consensual intimate images that meets the 48-hour limit. If it applies Source: TAKE IT DOWN Act text , FTC business guidance Post a plain-language notice that explains how to request removal, and make the request form work for people without an account. If it applies Source: TAKE IT DOWN Act text , FTC business guidance Give every removal request a tracking number and an alert that reaches you on weekends. If it applies Source: FTC business guidance , TakeItDown.ftc.gov If you have EU users, publish one electronic point of contact and terms that explain your content rules and moderation. If it applies Source: DSA Article 12 (mirror) , DSA Article 14 (mirror) If you host content for EU users, add an electronic notice-and-action form that confirms receipt and tells the reporter your decision. If it applies Source: DSA Article 16 (mirror) If you have no EU base but offer your service in the EU, appoint a legal representative in an EU country. If it applies Source: DSA Article 13 (mirror) , European Commission DSA page Show the price, how often it is charged, that it renews automatically, and how to cancel right next to the Subscribe button, before the card form. If it applies Source: 15 U.S.C. 8403 , Cal. 17602 (mirror) Get consent with a button or an unticked checkbox that names the charge, not with a line hidden in your terms. If it applies Source: 15 U.S.C. 8403 , Cal. 17602 (mirror) Save proof of each consent (time, user, price shown, terms version) for at least 3 years, or 1 year after the subscription ends if that is longer. Should do Source: Cal. 17602 (mirror) Send a confirmation email right after sign-up with the price, the renewal terms and how to cancel. Should do Source: Cal. 17602 (mirror) , Minn. Stat. 325G.57 Let anyone who signed up online cancel online, at once, from a visible link or button, with no phone call, chat or wait. If it applies Source: Cal. 17602 (mirror) , 15 U.S.C. 8403 If you show a save offer, keep a cancel button on the same screen as the offer. Should do Source: Cal. 17602 (mirror) , Stripe customer portal For a free trial or promo price longer than 30 days, email the customer before it ends: 3 to 21 days before for California, 5 to 30 days before for Minnesota. If it applies Source: Cal. 17602 (mirror) , Minn. Stat. 325G.57 For a plan with a first term of a year or more, send a renewal notice 15 to 45 days before it renews. If it applies Source: Cal. 17602 (mirror) Send every subscriber a yearly reminder with the product, the price, how often it is charged and how to cancel. Should do Source: Cal. 17602 (mirror) , Minn. Stat. 325G.57 Give subscribers 7 to 30 days notice before a price change, with how to cancel. Should do Source: Cal. 17602 (mirror) , Skadden on the NYC rule If you sell subscriptions inside a mobile app, check the screen before purchase against Apple guideline 3.1.2 and Google Play's subscription policy. If it applies Source: Apple guidelines , Google Play subscriptions Before each release, sign up and cancel as a test user, and confirm that no further charge is scheduled. Should do Source: Stripe customer portal , 15 U.S.C. 8403 Do not treat the vacated click-to-cancel rule as permission; follow ROSCA and the law of the states where most of your users live. Should do Source: Eighth Circuit opinion , FTC on Amazon , Skadden Sort every email your app sends into transactional or commercial, and keep promotions out of receipts, password resets and account notices. Must do Source: 16 CFR 316.3 , FTC CAN-SPAM guide Put a valid postal address in the footer of every marketing email: a street address, a registered PO box or a registered private mailbox. Must do Source: FTC CAN-SPAM guide , 15 U.S.C. 7704 Put a clear unsubscribe link in every marketing email, and keep it working for at least 30 days after you send. Must do Source: FTC CAN-SPAM guide , 15 U.S.C. 7704 Store every opt-out in your own database, and make every send script check that list before it sends. Must do Source: FTC CAN-SPAM guide Stop marketing email within 10 business days of an opt-out, and aim for the same day, because Yahoo asks for 2 days. Must do Source: FTC CAN-SPAM guide , Yahoo sender best practices Use a true From name and reply address, a subject line that matches the content, and a clear label when the email is an ad. Must do Source: FTC CAN-SPAM guide Set up SPF and DKIM for your sending domain (Gmail requires at least one from every sender), and add DMARC even if you send fewer than 5,000 emails a day. Should do Source: Google sender guidelines , Yahoo sender best practices If you send more than 5,000 emails a day to Gmail or Outlook.com, publish a DMARC record aligned with your From domain, on top of SPF and DKIM. Must do Source: Google sender guidelines , Microsoft postmaster policies Add the List-Unsubscribe and List-Unsubscribe-Post one-click headers to marketing email, plus a visible unsubscribe link in the body. Should do Source: Google sender guidelines , Yahoo sender best practices Keep your spam complaint rate below 0.1%, and never let it reach 0.3%. Should do Source: Google sender guidelines , Yahoo sender best practices Review what your email vendor and any agency send in your name, because you stay responsible for it. Should do Source: FTC CAN-SPAM guide Get prior consent before you send marketing email to people in the EU or UK, and use the soft opt-in only for your own similar products sent to existing customers. If it applies Source: ePrivacy Art. 13 (UK-hosted copy) , PECR reg. 22 For recipients in Canada, have express or implied consent, name yourself and your contact details, and honor unsubscribes within 10 business days. If it applies Source: CASL s. 6 , CASL s. 11 Before you send any marketing text, collect written consent that names the phone number and says consent is not a condition of buying. If it applies Source: 47 CFR 64.1200 , 47 U.S.C. 227 Honor STOP, unsubscribe and similar replies to texts at once, even though the rule allows up to 10 business days. If it applies Source: 47 CFR 64.1200 , FCC draft order Paste the rules block into the instruction file each of your tools reads, fill in every angle-bracket part, and commit it. Must do Source: Supabase changelog , GitGuardian Run the full audit prompt below before launch, and open the file and line for three PASS results yourself. Must do Source: Lovable security docs , OWASP A01:2025 Turn every FAIL and every UNKNOWN into a dated ticket, and fix the Must items before you take sign-ups. Must do Source: CPPA on Todd Snyder , California Attorney General on Healthline Check your privacy policy against the audit's vendor list and remove every promise the code does not keep. Must do Source: FTC on OkCupid , CalOPPA Sec. 22576 Keep a one-page tracker inventory and update it in the same change that adds a vendor, script or SDK. Must do Source: CPPA on Tractor Supply , GDPR Art. 28 (unofficial copy) Move safety settings that only live in a dashboard, such as session replay off, into code where you can. Should do Source: PostHog JS config , PostHog replay controls Rerun Stages 2 to 4 whenever you add a vendor, script, SDK, font or pixel. Must do Source: CPPA on Tractor Supply , PostHog data collection Rerun Stages 1, 3 and 5 when you add a form or a new kind of data, and update your app store privacy answers. Should do Source: Apple App Privacy details , Google Play Data safety Rerun Stage 9 whenever you change a price, a trial or the checkout. If it applies Source: ROSCA, 15 U.S.C. 8403 , California B&P Sec. 17602 Rerun Stages 3 and 7 when you add an AI feature or a new AI provider. If it applies Source: Apple App Review Guidelines , EU AI Act Art. 50 Test your unsubscribe and opt-out paths after every deploy that touches them. Should do Source: FTC CAN-SPAM guide , CPPA on Todd Snyder Book a lawyer before you collect health data, direct your app to children, or learn that children under 13 use it. If it applies Source: FTC Health Breach Notification Rule , FTC COPPA FAQ Book a lawyer review once you offer your app to people in the EU and they become a real share of your users. If it applies Source: GDPR Art. 3 (unofficial copy) , GDPR Art. 13 (unofficial copy) Write down the name and number of the lawyer you will call on the day you find a breach. Must do Source: GDPR Art. 33 (unofficial copy) , California SB 446 digest , 50-state survey Talk to Claude instead of typing to it. Ducktate turns what you say into clean text, on your Mac, and pastes it anywhere.
Get early access Do your own due diligence Not legal advice. This course is a starting point. It is not a complete list of what applies to your app.
Laws change, and they differ by state and by country. I checked the facts on this page on 2026-10-09. Check each linked source yourself before you act on it.
You are responsible for your own app. Before you rely on anything here, talk to a lawyer who is licensed where you and your users are.
