GitHub Copilot pre-launch checklist

52 checks in the order we run them, most severe first. Each one has a self-check you can do in the GitHub Copilot dashboard and your browser, and a fix direction. Free to use; nothing to sign up for.

Download .md

Defaults referenced come from GitHub's documentation, verified 2026-09-21, on the GitHub Copilot hub.

Secrets and keys
- NEXT_PUBLIC_ prefix on a secret
  In your hosting dashboard (Vercel: Project, Settings, Environment Variables) or your .env files, list every variable whose name starts with NEXT_PUBLIC_.
  Critical
- Secrets committed to the code repository
  Open your project on GitHub (or the code view in your builder) and look at the file list for .env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.
  Critical
- Service-role key shipped in the browser bundle
  Open your live app in Chrome, right-click anywhere and choose Inspect, then open the Sources tab.
  Critical
- Third-party API key in the JavaScript bundle
  Open your live app in Chrome, right-click, choose Inspect, then open the Sources tab.
  High
- Secrets and internals in error messages and logs
  Open your live app, right-click, choose Inspect, then the Network tab. Trigger an error on purpose: submit a form with a field left blank, or visit an address like /api/anything-made-up.
  High
Data access
- Firebase rules left in test mode
  Open the Firebase console, choose your project, then Firestore Database (or Realtime Database, or Storage) and open the Rules tab.
  Critical
- Record ids accepted without an ownership check
  Create two accounts in your app and add one record, such as an order or a note, in each.
  Critical
- Inverted policy logic
  In the Supabase dashboard, open Authentication, then Policies, and read every policy on a table that holds customer data.
  Critical
- Any signed-in user can read every row
  In the Supabase dashboard open Authentication, then Policies. Row Level Security (RLS) is the per-row access rule set Postgres applies to each query, and this page shows each policy's expression.
  Critical
- Row Level Security disabled on a table
  In the Supabase dashboard open Table Editor. Tables without Row Level Security (RLS, the per-row access rules Postgres applies to each query) show an RLS disabled or Unrestricted label next to the name.
  Critical
- RLS policy that allows everything with using (true)
  In the Supabase dashboard open Authentication, then Policies. Row Level Security (RLS) is the per-row access rule set Postgres applies to each query, and this page lists every policy per table.
  Critical
- Uploaded files in a public storage bucket
  In the Supabase dashboard open Storage and look for the Public label on each bucket; in Firebase open Storage, then the Rules tab.
  High
Login and permissions
- Admin routes without any login check
  Open a private browsing window so you are signed out.
  Critical
- Authorization enforced only in the browser
  Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab.
  Critical
- Default admin credentials left in place
  In the builder's code view, search the whole project for admin@, password, seed and demo.
  Critical
- Tokens trusted without server verification
  Sign in, open developer tools (right-click, Inspect), go to the Network tab and pick a request to your own API that carries an Authorization header or a session cookie.
  Critical
- Role chosen by the client at signup
  Open your signup page, open developer tools (right-click, Inspect) and the Network tab, then submit the form with a test email.
  Critical
- Password reset links that never expire
  Request a password reset for your own test account and keep the email.
  High
- Sessions that survive logout and password changes
  Sign in, open developer tools (right-click, Inspect), go to the Network tab and use Copy as cURL on a request that returns your account data.
  High
Payments
- Stripe webhook accepted without signature verification
  In the Stripe Dashboard, open Developers, then Webhooks, and copy the endpoint URL your app uses. It usually ends in something like /api/stripe/webhook or /functions/v1/stripe-webhook.
  Critical
- No idempotency on payment handlers
  In the Stripe Dashboard, open Developers, then Webhooks, select your endpoint and open a recent invoice.paid or checkout.session.completed event for a test account.
  High
- Price or plan taken from the client
  Open your app's pricing page in Chrome, press F12 to open developer tools (the browser's built-in inspector), and select the Network tab.
  High
- Subscription state trusted from local storage
  Sign in to your app with a free account, press F12 to open developer tools, select the Application tab, then Local Storage on the left.
  High
- Stripe test keys in production
  Open your live app's checkout, press F12, select the Network tab, and start a checkout. Look for requests to stripe.com or js.stripe.com and read their URLs and payloads for a key beginning pk_test_ or a session ID beginning cs_test_.
  High
AI features
- LLM API key exposed to the client
  Open your live app, press F12, select the Network tab, and use the AI feature once.
  Critical
- No output validation before actions
  List the things your AI feature can do beyond replying with text: run queries, call APIs, send messages, change records, fetch URLs, run code.
  Critical
- No spend cap on model calls
  Sign in to your model provider's console and open the billing or limits page (OpenAI: Limits; Anthropic: Settings, then Billing). Note whether a monthly spend limit and a spend alert are set.
  High
- Prompt injection through user content
  List every place where text from a user, a webpage, an uploaded file or an email reaches the model: chat boxes, ticket forms, document upload, URL summarisers.
  High
- Unbounded input length to the model
  Open the AI feature in your app and paste an unusually long text, for example a whole book chapter copied several times, then submit.
  Medium
Deploy and config
- AI agent with production credentials
  Open the folder the agent works in and look for .env, .env.local or similar files; note whether any value starts with sk_live_, contains the word prod, or is a service-role or admin key.
  Critical
- CORS open to any origin with credentials
  Sign in to the live app, open browser devtools, go to the Network tab and click any request to your API.
  High
- Dependencies with known vulnerabilities
  If your builder shows a package.json file or lets you export the code, open a terminal in that folder and run npm audit (or pnpm audit or yarn audit).
  High
- Debug mode left on in production
  On the live site, open a page address that does not exist, then open an API route with a broken parameter, for example a letter where an id is expected.
  Medium
- Missing security headers
  Open your published app in Chrome or Firefox, press F12 and choose the Network tab.
  Medium
- No automated checks before deploy
  Open the project's GitHub repository; if the builder has a GitHub sync, connect it first so the code is visible there.
  Medium
- Every change goes straight to production
  Open your hosting dashboard (Vercel: the Deployments tab) or the builder's publish panel and look at the recent deployments.
  Medium
Mobile
- Secrets in the mobile app bundle
  Open the project's .env files and app.json or app.config.js; list every variable whose name starts with EXPO_PUBLIC_ or that sits under extra.
  Critical
- Offline state corrupting data
  On two phones (or a phone and the simulator) signed into the same account, put one in airplane mode and edit the same record on both.
  High
- Certificate pinning absent
  Search the project for pinning-related words: pin, sha256, certificate, network_security_config, NSPinnedDomains, trustkit.
  Medium
Reliability
- No rate limiting on sensitive routes
  Open your app's login or "forgot password" page in Chrome, press F12 and choose the Network tab.
  High
- Background jobs that fail silently
  List every scheduled or background task your app has: on Vercel open Settings then Cron Jobs; on Supabase open Integrations then Cron, and Edge Functions; on Replit look for a Scheduled deployment.
  Medium
- Errors swallowed, spinner never stops
  Open your app in Chrome and sign in as a normal user.
  Medium
- Retries with no pause and no cap
  Open your app in Chrome, press F12 and choose the Network tab.
  Medium
- One process, one machine, nothing restarts it
  Find out where the app runs. In Replit, open the Publishing pane and read the deployment type. On a server or container host, open the provider's dashboard and look for "restart policy", "health check" or "process manager".
  Medium
Data integrity
- Deletes with no soft delete or audit trail
  In a test account, create a record in the app, then delete it using the app's own button.
  High
- Race conditions on counters and balances
  Open the app in two browser tabs signed in to the same test account that has a limited balance, seat count or single-use coupon.
  High
- Migrations that cannot be undone
  Open the project's files (in the builder's code view or the synced GitHub repository) and find the supabase/migrations folder.
  Medium
- Timestamps stored without a time zone
  In a test account, create a booking or event for a specific clock time tomorrow and note it.
  Medium
Performance
- No index on the columns you filter by
  In the Supabase dashboard open Advisors, then Performance Advisor, and read the list of suggestions.
  Medium
- One database query per list item
  Open a page in your app that shows a list (orders, projects, customers) in Chrome, press F12, choose the Network tab and filter by "Fetch/XHR".
  Medium
- List endpoints that return everything
  Open your app's main list page in Chrome, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
  Medium
- Whole table downloaded, filtered in the browser
  Sign in to your app as a normal user, open a page that lists your own items, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
  Medium

Questions

github copilot security checklist

The list above: 52 checks across 10 categories, most severe first. Each links to a page with what the issue looks like, a self-check and a fix direction. Download the Markdown file to tick items off in your own notes.

can i use this checklist without buying anything

Yes. That is the point of publishing it. If you run every self-check and fix what you find, you have done most of what the security sweep does. What our test adds is a second account, scripts that enumerate everything, and a written report you can show someone.

Prefer someone else to run it: the security sweep covers the critical items in 24 hours; the pre-launch check covers the full list. Or run the self-check tool.

GitHub Copilot pre-launch checklist

Secrets and keys

Data access

Login and permissions

Payments

AI features

Deploy and config

Mobile

Reliability

Data integrity

Performance

Questions