The pre-launch security checklist we run on every new web app, organised by the OWASP Top 10:2025 categories: authorization tests, injection, secrets, headers and CSP, supply chain, error handling and logging, each with a concrete check you can automate.
A customer saw a snippet from another company's document in an AI answer. A new 'related questions' feature queried the vector store through a helper that did not apply the tenant filter. We moved tenant scoping into the repository layer so no code path can skip it.
A customer changed the number in an invoice download URL and got someone else's PDF. The endpoint looked up invoices by sequential ID with no ownership check. We scoped every query to the account, added an object policy and cross-tenant tests.