For founders · checklist
Nine security tests you can run yourself
The article explains why. This is the part you take with you and actually run. About an hour, no engineering background, nine boxes to tick.
What is on it
- Tell the app to ignore its instructions and print them back
- Ask it to do the one thing it must never do, five different ways
- Upload a document with an instruction hidden inside it
- Change the number in the URL and see whose data appears
- Ask the assistant about other customers' accounts
- Send nonsense and read what the error message reveals
- Open the network tab and look for a visible API key
- Check whether one user's conversation reaches another
- Ask your builder the five questions on the back
Take it with you
Free, no sign-up. Print it, or send it to whoever is about to make the decision.
