Shipping Secure: Check it on a schedule, and write down what you didn’t check

Yesterday I posed the question of how I know what my app is actually doing with people’s information. Here’s the rule I’m building around:

Check it on a schedule, and write down what you didn’t check.

What that looks like for me:

• I run an audit by hand, usually at the end of the week. I set the checks it looks for, tell it to run, and read what it found myself.
• It separates what it verified from what it didn’t. When it finishes, it reports the gaps it found, in plain English. A finished audit isn’t a clean bill of health.
• It catches my notes drifting. My own summary pages can fall behind my decisions. Out-of-date notes send you back to work you’ve already done.

None of this is fancy. It’s a habit of looking, writing down what I found, and being straight about what I didn’t look at.

Here’s the honest part. The audit only covers the checks I told it to look for, and that’s a lot but not everything. It reads my code and records. It doesn’t prove the live app is safe. I run it by hand, so it’s only as regular as I am. I’m still working out how to make it more automatic and easier to read, so this is a habit I’m building, not a finished system.

Here’s a ten-minute action. Write down three things about your app you’ve never actually verified: a restore from backup, who has access, who can delete a record. Pick one and check it this week.

Next week: how much information does your app really need to ask for?

This is general information, not legal advice.