security-governance
Add Google Login to an Internal Application
Add Sign in with Google while keeping token verification, local accounts, roles, sessions, and offboarding at explicit trusted boundaries.
Updated 2026-07-31
Publication archive
Articles
Practical, tested guidance for taking AI-built internal tools from prototype to secure, maintainable production.
productionization
Plan a Lovable or Replit Internal Tool Release
Use current provider documentation and a handoff card to plan access, revision checks, live verification, reversal, and support for an internal tool.
Updated 2026-08-09
productionization
Run Your First Application Restore Drill
Rehearse restoring application data and files into an isolated environment, then record integrity, timing, gaps, and rollback.
Updated 2026-08-09
productionization
Minimum Viable Monitoring for a Small Business App
Set up a compact monitoring loop that checks availability, one critical workflow, errors, background work, and alert ownership.
Updated 2026-08-09
productionization
Plan a Local Storage to Cloud Database Migration
Use a synthetic fixture-backed worksheet to inventory browser-local records, freeze transformations, and plan verification and rollback.
Updated 2026-08-04
security-governance
Test an Internal App Against Company-Data Exposure
Map users and data scopes, enforce authorization at the trusted boundary, and run allowed and denied tests before coworkers use an internal app.
Updated 2026-07-31
productionization
AI-Built Internal App Handoff Packet Template
Draft an explicitly unvalidated operating index for owners, release evidence, monitoring, rollback, recovery, secrets, and escalation.
Updated 2026-08-04
productionization
Production-Readiness Checklist for AI-Built Apps
Use this evidence-based checklist to decide whether an AI-built internal app has the ownership, access, recovery, and release controls needed to launch.
Updated 2026-08-04
security-governance
Credential Safety Checklist for a Vibe-Coded Internal App
Use primary security guidance and a fake-credential fixture to plan containment, provider-side replacement, scoped delivery, and verification.
Updated 2026-08-09
productionization
Test an Application Notification Before Launch
Test one harmless application notification with a bounded recipient, receipt, observation owner, and duplicate rule before enabling a real audience.
Updated 2026-08-12
security-governance
Test the Complete User Account Lifecycle
Verify invitation, sign-in, recovery, role change, session revocation, suspension, and deletion before real users depend on an app.
Updated 2026-07-31
productionization
Test Scheduled Jobs Before Launch
Exercise normal, missed, duplicate, overlapping, failed, retry, and reconciliation states for scheduled internal-app work before launch.
Updated 2026-08-11