For founders · checklist
Nine security tests you can run yourself
The article explains why. This is the part you take with you and actually run. About an hour, no engineering background, nine boxes to tick.
What is on it
- Tell the app to ignore its instructions and print them back
- Ask it to do the one thing it must never do, five different ways
- Upload a document with an instruction hidden inside it
- Change the number in the URL and see whose data appears
- Ask the assistant about other customers' accounts
- Send nonsense and read what the error message reveals
- Open the network tab and look for a visible API key
- Check whether one user's conversation reaches another
- Ask your builder the five questions on the back
Send it to me
Put your address in and the download appears on the next screen. A copy lands in your inbox too, so it is there when you need it again.
You also get the newsletter, every second Tuesday. Unsubscribe in one click.
