An AI-built app can work perfectly while any stranger can read its customers' data. Nothing on screen shows it.

Ask whoever built it: which tables hold user data, and what stops a logged-out stranger from reading each one? A good answer is a list. "It should be fine" means nobody has checked.

Nobody to ask? My free kit walks you through all ten checks, with a scorecard and an AI coach.

Andrés, this is the check most founders never run, because nothing breaks until someone looks. Asking for the list of tables and who can read each one is a test any owner can do without writing code. Row level access belongs on the launch checklist, not the cleanup list.