# Before people use your app: a checklist Before you send the link, check eight things: your keys, a sign-in for anything private, who can see whose data, a privacy note, your own copy, a phone, how to go back, and your web address. Claude Code can check most of them when you ask. Last checked 17 October 2026. The same page on the web: https://dev.fline.sh/guides/checklist-before-your-first-users If you built your app by asking Claude Code, what some people call vibe coding, you can check it by asking too: each item below comes with the sentence to type. Your host looks after where your app lives, like the padlock on its link, and what your app's own code does is yours, on any host. I build fline, hosting for apps made with Claude Code, so I'll also say where fline helps and where it doesn't. ## What should I check before people use my app? Check these eight things before you send the link: 1. **Keys.** Live keys are out of the chat, out of your project's files and out of the code that runs in the browser. 2. **A sign-in.** Anything private, and any page meant only for you, needs one. 3. **Whose data.** Each person sees and changes only their own. 4. **A privacy note.** People can read what your app keeps about them and how to have it deleted. 5. **Your own copy.** You can download what you can't lose, and you keep it somewhere else. 6. **A phone.** Your app works on a small screen, for someone who has never seen it. 7. **Going back.** You know how to change your app, and how to put an earlier version back. 8. **Your address.** People get a web address you own, with the padlock. ## 1. Are your keys out of the code and the chat? Type live keys only on your host's private page, never in the chat with Claude Code and never in a file in your project folder. A key is a password your app uses to reach a service like payments or email, and whoever holds it can use that service as you. Claude Code can read the chat and, by default, the files in your project folder. Anyone who opens your app can find a secret key in the code that runs in their browser. The database's address line holds a password too. If your app takes payments, try them in the payment service's test mode before you switch to live keys. ```prompt Tell me which files in my project hold keys or passwords, and make sure no secret key ends up in the code that runs in the visitor's browser. Don't ask me to paste keys into the chat. ``` **On fline.** When your app needs a key, Claude Code gives you a link to a private fline page that works once, for 10 minutes. Claude Code sees that you entered the key, not what you typed, and once it's saved nothing in fline shows it again. A key left in a file in your project can end up inside your app when fline builds it. Claude Code can also save a key it already holds, from the chat or a file, so replace any live key it has seen. Your dashboard lists the AI coding apps you've connected, and you can disconnect one at any time. [Is it safe to give Claude Code your API keys?](https://dev.fline.sh/guides/claude-code-api-keys) covers where keys go and how to replace one. ## 2. Does anything private need a sign-in? Yes. Your app's link is public, and anyone who has it can open your app. Links get forwarded and pasted into group chats, so a page nobody knows about isn't hidden. That includes pages meant only for you, like an admin page where you see every order. To test it, open a private window in your browser, where you're not signed in, and try the addresses of your private pages. ```prompt List every page in my app and say who can open it without signing in. Anything with private information, and any page meant only for me, should need a sign-in. Fix the ones that don't. ``` ## 3. Can each person see only their own data? Each person who signs in should see and change only their own things. Test it yourself. A page can look right while the part behind it hands anyone's data to anyone who asks. Make two accounts. Save something as the first, then sign in as the second and try to open it. If the page's address has a number in it, like an order number, change the number and see what appears. ```prompt Check that each person who signs in can see and change only their own data, in the pages and in the parts behind them that the pages get data from. Show me how you checked. ``` ## 4. Do people know what happens to their data? Tell people, on a short page in plain words, what your app keeps about them, why, who can see it, where it's kept, for how long, and how someone can ask you to delete theirs. Name the other services that handle it too, like your host and any email or payment service your app uses. The law where you and your users live may ask for more, so if your app collects anything sensitive, ask someone who knows the rules there. ```prompt Write a short privacy page for my app in plain words: what it collects about people, why, who can see it, which other services handle it, and how someone can ask me to delete theirs. Mark anything you're not sure of so I can check it. Also give me a way to delete one person's account and everything they saved. ``` **On fline.** Your app, and any database fline creates for you, run on one machine that fline rents from Contabo, and we don't promise which country it's in. Your dashboard keeps 7 days of what your app prints, so ask Claude Code to keep people's private details out of it. fline's [privacy page](https://dev.fline.sh/privacy) lists what fline keeps and for how long. ## 5. Do you have your own copy of what you can't lose? Keep your own copy of anything your app holds that you can't lose, like orders, bookings or sign-ups, somewhere other than your host. Machines fail and mistakes happen. Ask Claude Code for a way to download everything, then download it often. Keep a copy of your project folder somewhere other than your computer too. ```prompt Add a page that only I can open, after signing in, where I can download everything my app has saved as a spreadsheet file. ``` **On fline.** We don't promise backups yet, there's no way to restore, and there's no button to download your database. [Do I need a database for my app?](https://dev.fline.sh/guides/database-for-your-app) says what fline creates and what it doesn't do yet. ## 6. Does it work on a phone? Open your app's link on your phone and use it the way a new person would: sign up, do the main thing your app is for, and sign out. A page that looks fine on a laptop can be cut off or hard to tap on a small screen. Then ask a friend to try it on their phone without your help, and watch where they get stuck. If your link only opens on your own computer, your app isn't online yet: see [why an app only works on your computer](https://dev.fline.sh/guides/app-only-works-on-my-computer). ```prompt Check every page of my app on a phone-sized screen. Fix anything that's cut off, too small to read or too small to tap, and any link that still points at the preview on my computer. ``` ## 7. Do you know how to update it, and how to go back? Before people rely on your app, know how you'll change it and how you'll go back if a change breaks something. Make each change on your computer, check it in the preview, then ask Claude Code to update the app online. Ask it to save each version that works with Git, a tool that keeps your project's history. And open your app yourself now and then, because nobody may tell you when it stops working. ```prompt Save this working version of my project with a short note, so we can come back to it. Then tell me how we'd put the earlier version back on fline if the next update breaks something. ``` **On fline.** When you update your app, the current version keeps running while the new one is prepared. To go back, ask Claude Code to put an earlier version back. There's no button for it on your dashboard yet. It keeps your current keys, and it doesn't change what's in your database. fline emails you when a build starts, when your app goes live, and if it can't get your app built and started, but not if your app stops working later. [Change your app after it is online](https://dev.fline.sh/docs/update-your-app) has the steps. ## 8. Is it at your own web address, with the padlock? Send people an address they recognize, with the padlock in the browser's address bar, which means what they type is encrypted on its way to the site. A short address you own, like www.yourbakery.com, is easier to remember than a long one made automatically, and you keep it wherever your app runs. ```prompt Attach www.[YOURNAME].com to this project on fline and tell me which record to add, and where. ``` **On fline.** Your app starts with a long link ending in apps.dev.fline.sh. A www address works with any domain company: you add one record at the company you bought it from, your dashboard shows which one and keeps checking for 48 hours, and fline sets up the padlock and renews it. An address without www works today only if your domain is with Cloudflare. [Use a web address you own](https://dev.fline.sh/docs/web-address) has every step. ## Where fline fits fline is hosting for apps you build with Claude Code on your own computer. If yours isn't online yet, [how to get your Claude Code app online](https://dev.fline.sh/guides/put-claude-code-app-online) walks through it. Some things it doesn't do yet. During the private beta every app runs on one rented machine, with no spare, no uptime promise and no backups you can count on, and a project can't be paused, only deleted. So fline suits trying your app with your first users, rather than running a business that can't afford to be offline or to lose data. It's free during the private beta, with no card, and we open accounts by hand, a few at a time. [What fline does today](https://dev.fline.sh/facts) has the full list, with a date on it. Built it with Claude Code, and getting ready for your first users? [Ask for early access](#join). ## Questions people ask ### Is my app safe to share? No checklist can promise that, but you can close the usual gaps before you share it. If it stores nothing private, check where your keys are and the address you send. If it holds people's names, messages or orders, also check that private pages need a sign-in and that each person sees only their own data. ### Can Claude Code check my app for security problems? It can look for many of them when you ask, one item at a time. Treat its answer as a second opinion, not proof: Anthropic's own security guide says the person using Claude Code is responsible for reviewing what it proposes. Also do the checks you can do yourself, like signing in as two different people. If your app holds health, money or children's information, ask a person who checks apps for a living. ### Does fline check my app's code? No. fline takes care of where your app lives: the padlock on its link, a private page for your keys, and a database it creates and runs. That database is on the internet so your app can reach it, and it takes only encrypted connections with its password. What your app's own code does, like which pages need a sign-in and who can see whose data, is yours to check, and Claude Code can help. ### Do I need a privacy policy for my app? If your app collects anything about people, even just email addresses, give it a short page in plain words that says what it collects, who can see it and how someone can have theirs deleted. Claude Code can draft it from your app's code, and you check that every line is true. The law where you and your users live may ask for more. ### What if I find a problem after people start using it? Ask Claude Code to fix it on your computer and put the fixed version online. If the problem came with your last update, it can put an earlier version back while you work on the fix. If a key got out, get a new one from the service that issued it: [your API key leaked: what to do first](https://dev.fline.sh/guides/api-key-leaked) has the steps. If other people's information was exposed, tell the people affected in plain words. On fline a project can't be paused yet, so if you need your app offline while you fix it, the way to do that today is to delete the project. A database fline created for you stays, and putting your app back afterward means a new project with a new link.