Builders repeatedly report the same afternoon-testable failures: another user can open your object URLs, refunds leave entitlements on, and /admin still loads for strangers. The steps below turn those reports into a release runbook for apps you own.
- Prepare throwaway accounts and fake data. Create User A and User B with test emails. Seed A with profiles, orders, or notes you are willing to expose if a check fails.
- Run the ownership probe. Log in as A, copy detail URLs, switch to B in another browser, paste and mutate IDs. Open list views as B. Mark pass/fail on the gate.
- Switch your payment provider to test mode. Never use live cards or live secret keys for this checklist.
- Exercise entitlements. Subscribe with a test card, confirm unlock, cancel, refund, and attempt a failing card. Confirm access changes match the events — not the success redirect alone.
- Smoke admin URLs. Logged out and as a normal user, visit /admin, /dashboard, /debug, /internal, and any AI-generated admin paths you remember.
- Record webhook verification notes. Ensure signature checks use the raw body and handlers are idempotent before you mark refund=pass.
- Update the interactive gate. Set each module to pass/fail/untested and copy the remediation list into your launch doc or issue tracker.
- Self-check after the next AI “security fix”. Re-run ownership and admin probes; coding models often widen policies to make errors disappear.
Stop at the first hard fail if you handle sensitive data — hire help rather than shipping. This gate is a floor for three modules, not a full audit.