Security and LGPD checklist before launching your app (2026)

Rushing to launch is security's worst enemy. AI tools ship a working app in hours, but they optimize for "it works," not "it survives an attack" — and if you don't code, you have no way to review what was generated. This is the minimum checklist, split into three fronts, to run before you put your app in front of the world.

1. Web application security

• No sensitive files exposed: confirm that .env, .git, backup.sql, and docker-compose.yml aren't publicly accessible.
• Security headers present: Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Frame-Options, and X-Content-Type-Options.
• HTTPS enforced and TLS valid: every HTTP request must redirect to HTTPS, with a certificate inside its validity window.
• Cookies protected: Secure, HttpOnly, and SameSite attributes configured.
• CORS restricted: avoid Access-Control-Allow-Origin: * on routes that return data.
• No secrets in the front end: API keys and tokens must never ship in the JavaScript sent to the browser.

2. Code and backend security

• Real authentication and authorization: the API must validate who's calling and whether that person is allowed to see that data — never trust the front end to hide information. That's exactly the flaw that leaked Kippu's data.
• No classic vulnerabilities: run a static analysis (SAST) looking for SQL Injection, Cross-Site Scripting (XSS), and authentication flaws.
• Dependencies with no known CVEs: outdated packages are an open door — audit package.json / requirements.txt.
• No secrets in Git history: committed keys and passwords stay in history even after being removed from the code.

3. LGPD compliance

• An active privacy policy, accessible inside the app.
• A cookie notice with real consent — not just a decorative banner.
• A defined legal basis for every piece of personal data collected (LGPD Arts. 7 and 9).
• A channel for data subjects to exercise their rights: access, correction, deletion, and portability (Art. 18).
• Visible contact info for the Data Protection Officer (DPO), as required by Art. 41.

The good news: almost everything on this list is verifiable automatically, before launch. ecoa's security and LGPD analysis runs these checks from your app's URL (and its repository, for the code), flags how severe each finding is, and generates a ready-to-paste fix prompt for your AI tool. Catching a hole while your app still has few users is incomparably cheaper than dealing with a leak later — in money, reputation, and compliance.