Is your app ready for the rest of the company?

How does signing in work in this app? Please tell me:
1. Is there any page, screen, or piece of data that can be reached without being signed in? Check the server side, not just whether the button is hidden.
2. Does it use an established login service (for example Google or Microsoft sign-in, Supabase Auth, Clerk, Auth0, Firebase Auth), or did we build our own?
3. If we built our own, how are passwords stored?

Once someone is signed in, what decides which records they can see and change?
1. If a user changed an ID in the web address or in a request (for example /orders/12 to /orders/13), would the app stop them from seeing something that isn't theirs? Show me where that check happens on the server.
2. Are there different kinds of users (for example admins vs. regular staff)? Where is that enforced?
3. If the app uses a hosted database like Supabase or Firebase, are its access rules (sometimes called "row level security" or "security rules") turned on and actually restricting anything?

List every secret key, password, or token this app uses to connect to other services (for example database, email, payments, AI services).
For each one, tell me:
1. Where is it stored? Is it written directly in the code, or kept in a separate settings/environment file?
2. Could it end up in the code that's sent to people's browsers?
3. Has it ever been committed to the code history (for example on GitHub), even if it was removed later?

How are user accounts managed in this app? If an employee leaves the company, what are the exact steps to remove their access? Is there any way to sign in with our company accounts (for example Google Workspace or Microsoft 365) instead of a separate username and password?

Make me a plain-language list of every type of information this app stores or handles. Group it into: information about our customers, information about our employees, financial information, and anything else. Flag anything that would count as personal or sensitive information (names, contact details, ID numbers, financial, health, HR).

List every outside service or company that stores or receives data from this app (for example the database host, file storage, email service, analytics, error tracking). For each one, which account is it under, and if you can tell, which country or region is the data stored in?

Does this app send any information to an AI service (for example OpenAI, Anthropic, Google)? If so, which features do it, exactly what information gets sent each time, and which account and plan is being used?

Is the data in this app backed up? Tell me:
1. What's backed up (the database, uploaded files, both)?
2. How often, and how far back can we go?
3. What are the exact steps to restore a backup, and has that ever been done?
4. If someone accidentally deleted a bunch of records, how would we get just those back?

What happens when something goes wrong in this app, for example a save fails, an outside service is down, or there's a bug? Does the user see a clear message? Is the error recorded anywhere? Would I or anyone else get notified? Are there places where a failure would happen silently?

Look for places where real-world use could cause problems:
1. What happens if two people edit the same record at the same time?
2. What happens if someone double-clicks a save or submit button?
3. Is what people type checked on the server (for example required fields, valid emails, sensible numbers), or only in the browser?
4. Are there any limits on file uploads (size and type)?
List anything that could lead to lost, duplicated, or corrupted data.

Where is this app running right now? List every service and account it depends on to stay online (hosting, database, domain name, email, and so on). For each one: is it a free or paid plan, and are there limits on that plan that we could hit (for example usage limits, the app going to sleep when idle, or data limits)?

Which parts of this app cost money based on how much it's used (for example hosting, database size, file storage, emails sent, AI requests)? Roughly what would it cost per month with 50 people using it every day? Are there any places where one person could accidentally run up a big bill, for example by triggering lots of AI requests?

Where does the code for this app live? Is it saved in a code repository like GitHub, and does it have a history of changes? Write a short summary of how the code is organized, so that a developer seeing it for the first time could understand it. Is there a README file explaining how to run it?

What outside packages and libraries does this app depend on? Are any of them out of date, no longer maintained, or known to have security problems? If you're able to run a security check on the dependencies (for example "npm audit"), please do and explain the results in plain language. Don't fix anything yet.

When I ask you to change this app, where do those changes go? Do they go straight to the live version that people are using, or is there a separate test copy? Are there any automated tests? If a change broke something, how would we undo it?

Write a one-page summary of this app for our IT team, in plain language. Include: what it does, who uses it, what information it stores, which outside services and accounts it relies on, how people sign in, and any risks or gaps you're aware of. Be honest about the gaps. This is to start a conversation, not to get it approved.