Security basics before launch

• No secret keys in the browser code.
• Every database table locked so users only see their own rows.
• Payments unlocked by webhook only.
• Rate limits on anything that calls AI.

The Launch Checker's checklist covers these.