These won’t find everything, and a clean result doesn’t prove you’re safe. But they’ll find the things that most often catch small businesses out, and most of them only take minutes.
Whose email owns it all?
Look at the account that owns the app, the database and the web address. If it’s somebody’s personal email, move it into a company account. How to find out
Can anyone else get in?
Name a second person who could sign in to every part if the first were unavailable. Then have them try it. If you can’t name anyone, that’s your first job. Key-person risk
Is two-step sign-in on?
Check every account that matters, starting with email, because password resets for everything else go there. Make sure the codes don’t all go to one person’s phone.
Who’s on the user list?
Open the list of users and administrators in each system. Do you recognise them all? Do they all need that level of access? Anyone who has left should go today. A leavers’ checklist
Run the built-in security check
Many AI builders and database dashboards have a security scan or advisor. Run it and read the results, and ask the tool to explain any warning in plain English. Treat it as a floor rather than a ceiling.
Try being a second customer
Make two test accounts. Sign in as one, and look for anything belonging to the other. Try changing a number in the page address, for example from /orders/1041 to /orders/1042. Do this only on your own system. Why this matters
Try signing up as a stranger
Use a new email address, on your phone, not on the office network. Do you have to confirm the address? Could you see prices or customer details straight away? Could you sign up as a member of staff?
Look for secrets
Is everything in the tool’s secure settings, or are there keys in the code? Is your GitHub repository private? How to look
Can you get it back?
Are there backups? When did someone last try restoring one? Could you get your data out today in a form you could use elsewhere? Do it once to find out.
Would you know if it stopped?
List what runs automatically, such as nightly copies and emails. For each, ask who would be told if it failed. If the answer is “a customer”, turn on failure alerts. The quiet parts that break
What next?
Write down what you found, and fix the easy ones today. If you turned up something worrying, such as customer data you can see when you shouldn’t, deal with that first, and tell us if you’d like help. If you found nothing, well done, though it’s worth remembering what these checks can’t see: the most serious problems are usually only visible from outside the app, using methods that need some experience and your permission.
That’s what an audit is for.
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
