Before you hand any AI your email, calendar, or payment data, run these five checks. Each one is a few clicks. You do not need a security background.
Fail check 1 or 2 and you stop, do not connect it to anything that matters. Checks 3, 4, and 5 are dealbreakers for anything touching money or client data.
Log in, open your browser dev tools, and look at the web address or a request ID as you move around. Change a number in it (say /742 to /743) and reload.
FAIL: you see a different account's data. That is the most common way vibe-coded apps get destroyed.
PASS: it only ever returns your own data, because it derives every request from your logged-in session, never a number in the URL.
In dev tools, check the network calls and page source for API keys or tokens for the tools it connects to.
FAIL: you can see the keys. Anyone can copy them and run up your bill or reach your accounts.
PASS: privileged calls happen on their server, and the keys never touch your browser.
Confirm the site forces HTTPS (the lock, and it will not load over plain http). Ask the vendor two questions: is my data encrypted at rest, and are passwords hashed, not stored in plain text.
FAIL: no straight answer, or "we store your password so we can email it to you."
PASS: HTTPS enforced, data encrypted at rest, passwords hashed, and ideally two-factor login available.
Ask it to send an email or change something. Watch whether it just does it, or stages it for your approval first.
FAIL: it sends, posts, or deletes on its own. A "fully autonomous" agent on your real accounts is a liability, not a feature.
PASS: approve-then-execute is the default. Nothing leaves without you releasing it.
If it connects to Gmail or Google, has it completed Google's OAuth verification? Is there any outside review, a security page, a real company behind it?
FAIL: an unverified app asking for full inbox access from a solo builder with no accountability.
PASS: verified by Google, a real entity, and a stated security posture you can read.
This is the exact process I run on my own product before every release. APEX passes all five, and this checklist is the short version of how I know.
This checklist tells you what to check. The Kit shows you exactly how to run each test, what a pass and a fail actually look like, how to fix a fail or what to demand from the vendor in writing, plus a copy-paste vendor questionnaire and a one-page scorecard you can grade any tool with before you connect it.
Get the AI Security Kit →Instant access. Lifetime updates.