I Audited Every Site and App I Own. Here's What I Found.

I build a lot of things. Websites, apps, little tools, games, stores. And like a lot of founders right now, I build them fast, with AI doing a big share of the typing. That speed is a gift. It's also how I ended up with a list of problems I didn't know I had.

A while back, a stranger signed up for one of my apps. Nobody I knew, nobody I'd invited. That's supposed to be good news, right? A real user! Instead my first thought was: what exactly can this person see? I couldn't answer that with confidence. So I stopped building and started checking. Not just that app, but every site and app I own, one by one, against the same long checklist.

This post is what I learned doing that, and why I now think a pre-launch website audit is the single most underrated step in shipping anything.

"It works on my screen" is not the same as "it's ready"

Here's the trap. When you build something yourself, you test it the way you use it. You log in as you. You click the buttons you designed. Everything works, so you assume everything's fine.

Real users don't behave like you. Neither do bots, and neither do the people who go looking for weak sites on purpose. The questions that matter before launch are the ones you never think to ask when you're the only user:

• If I'm logged in as one customer, can I change a number in the URL and see another customer's data?
• Is my database or file storage readable by anyone on the internet?
• What happens when someone submits the signup form 10,000 times in a minute?
• Does my site load anything that tracks visitors before they agree to it?
• Can someone using a screen reader or a keyboard actually complete a purchase?

None of those show up when you click around your own site. They only show up when you test for them on purpose.

What I actually found

I'm not going to pretend my projects were a disaster. Most of them were in decent shape. But "most" isn't good enough when real people's information is involved, and a few findings genuinely surprised me:

• A database anyone could read. One of my game apps had its data rules left far too open. Nothing bad had happened yet, but "yet" was doing a lot of work in that sentence.
• A homepage that broke itself. A routine cache cleanup deleted one small configuration file, and suddenly my homepage downloaded as a compressed file instead of showing the page. Visitors saw garbage. I only caught it because I was checking.
• Server software that needed an urgent patch. A serious PHP vulnerability went public in October 2026, and I had to confirm the version every site was actually running, not the version I assumed it was running.
• Privacy pages that didn't match reality. In a couple of places my policy said one thing and the code did another. That gap is exactly the kind of thing that turns a complaint into a legal problem.

Every one of those was fixable, and most took less than an hour once I knew about them. The expensive part is not knowing.

Why this matters more in 2026 than it used to

The numbers are hard to ignore. IBM's 2025 Cost of a Data Breach study put the global average cost of a breach at $4.44 million, and $10.22 million in the United States, an all-time high for any region. Most small businesses won't see numbers that big, but they also don't have the cash to absorb even a fraction of it.

Attackers are also going straight for the software. Verizon's 2025 Data Breach Investigations Report found that exploiting a vulnerability was the way in for about 20% of breaches, up 34% from the year before. That's not a hacker guessing your password. That's someone finding a hole you left open.

And it's not only security. A site that's slow or broken on a phone quietly loses customers. Google's research found that 53% of mobile visitors leave a page that takes longer than three seconds to load. A pre-launch check that catches a five-second homepage is a check that pays for itself.

What a good pre-launch audit actually covers

When I say "audit," I don't mean someone glancing at your homepage and telling you to change the font. A useful website security audit before launch looks at the whole thing:

1. Security: who can see and change what, whether admin pages are really protected (not just hidden), whether keys or passwords are exposed in the browser, and whether payments can be faked.
2. Privacy: what data you collect, where it goes, whether trackers wait for consent, and whether your privacy policy tells the truth.
3. Legal readiness: terms, refund rules, cookie notices, accessibility, and extra rules if kids, health or money are involved. (An audit flags these. A lawyer decides them.)
4. Reliability and appearance: broken links, error pages, mobile layout, load speed, backups you've actually tested, and what happens when something fails at 2 a.m.

The most important word in all of that is tested. A privacy policy existing doesn't mean your site follows it. A cookie banner existing doesn't mean trackers wait for it. Having a backup doesn't mean you can restore it. A real audit checks behaviour, not just whether the right pieces are present.

Why I built LaunchGate

After going through all of this on my own projects, I turned the process into a service: LaunchGate. The idea is simple. Nothing goes live until it passes the gate.

I want to be honest about what that means, because this industry is full of overpromises. No audit makes a site "unhackable," and anyone who guarantees that is selling you something. What a careful audit does do is find the problems that are most likely to hurt you and your customers, test them on a safe copy, and hand you a plain-English list of what to fix first. It's the difference between hoping you're protected and knowing where you stand.

Your customers are trusting you with their information the moment they sign up. Doing your best to protect them isn't just good security. It's good business, and it's the right thing to do.

Before you launch, ask yourself one question

If a stranger signed up for your app tomorrow, could you say with confidence what they can and can't see?

If the answer is "probably," that's your sign. Get a free launch check or take a look at our sample audit report to see exactly what you'd get.