# Clerk pre-launch checklist

From BuildThenTested (https://buildthentested.com/stack/clerk/). 10 checks in the order we run them, most severe first. Each check links to a page with what it looks like, a self-check and a fix direction.

Defaults referenced are from Clerk's documentation, verified 2026-09-21. Tick a box only after you have seen the result yourself.

## Secrets and keys

- [ ] **NEXT_PUBLIC_ prefix on a secret** (critical). In your hosting dashboard (Vercel: Project, Settings, Environment Variables) or your .env files, list every variable whose name starts with NEXT_PUBLIC_.
  https://buildthentested.com/patterns/next-public-env-var-exposes-secret/

- [ ] **Secrets committed to the code repository** (critical). Open your project on GitHub (or the code view in your builder) and look at the file list for .env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.
  https://buildthentested.com/patterns/secrets-committed-to-repo/

## Data access

- [ ] **Record ids accepted without an ownership check** (critical). Create two accounts in your app and add one record, such as an order or a note, in each.
  https://buildthentested.com/patterns/idor-on-record-ids/

## Login and permissions

- [ ] **Admin routes without any login check** (critical). Open a private browsing window so you are signed out.
  https://buildthentested.com/patterns/admin-routes-without-auth/

- [ ] **Authorization enforced only in the browser** (critical). Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab.
  https://buildthentested.com/patterns/authorization-only-in-browser/

- [ ] **Tokens trusted without server verification** (critical). Sign in, open developer tools (right-click, Inspect), go to the Network tab and pick a request to your own API that carries an Authorization header or a session cookie.
  https://buildthentested.com/patterns/jwt-accepted-without-server-verification/

- [ ] **Role chosen by the client at signup** (critical). Open your signup page, open developer tools (right-click, Inspect) and the Network tab, then submit the form with a test email.
  https://buildthentested.com/patterns/role-chosen-by-client-at-signup/

- [ ] **Sessions that survive logout and password changes** (high). Sign in, open developer tools (right-click, Inspect), go to the Network tab and use Copy as cURL on a request that returns your account data.
  https://buildthentested.com/patterns/sessions-never-invalidated/

## Payments

- [ ] **Price or plan taken from the client** (high). Open your app's pricing page in Chrome, press F12 to open developer tools (the browser's built-in inspector), and select the Network tab.
  https://buildthentested.com/patterns/price-or-plan-taken-from-client/

- [ ] **Subscription state trusted from local storage** (high). Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.
  https://buildthentested.com/patterns/subscription-state-trusted-from-local-storage/

---

We test against a defined checklist and report what we find. We do not guarantee that an app is free of vulnerabilities. We are not a certified penetration-testing firm and do not issue compliance attestations. We do not rebuild your app; fixes are yours or your developer's, and we re-check them.

Questions: hello@buildthentested.com