AI-assisted development makes it possible to build a SaaS product very quickly. It does not make the product safe by default. Speed often creates a specific class of launch risk: the interface works, the happy path works, but the boundaries between users, roles, billing states, and data have not been tested carefully.
That is the problem I am working on with Preflight.
Start with identity
Authentication answers who a user is. Authorization answers what that user may do. Many serious bugs happen because a route checks the first and assumes the second.
Every sensitive action should be tested with the wrong user, wrong role, missing session, expired session, and direct API request. Hiding an admin button in the interface is not authorization. The server must enforce the rule.
Follow the data
For each important object—accounts, projects, invoices, messages—trace how it is created, read, updated, and deleted. Ask whether identifiers can be guessed or replaced. If the product uses row-level security, test policies with real role combinations rather than assuming the policy text matches the intended behavior.
Treat billing as security
Stripe integration creates its own trust boundary. Prices and entitlements should be decided server-side. Webhooks need signature verification and idempotent handling. A user should not gain a paid capability because a client-side flag changed or a request was replayed.
Secrets and deployment
Repositories, build logs, preview deployments, and client bundles can all expose secrets. A launch review should scan history, not only the current files. It should also inspect security headers, dependency risk, debug routes, verbose errors, storage permissions, and forgotten test accounts.
No scanner understands the full intent of an application. The strongest review combines automated checks with a human reading the critical paths. The goal is not a report full of warnings. It is a short list of verified problems, evidence, and fixes that a founder can act on before users arrive.