Manuel ZamoraWhat I check first in an app someone else built
The handful of things I open first, whether an agency or an AI tool wrote it.
When a founder asks me to look at their app, I don't start with the code. I start with the things that can hurt them.
Who owns the accounts. The repository, hosting, domain, database. If they aren't in the founder's name, nothing else matters yet.
Whether anyone else can ship it. Can a new engineer get it running and deploy a change? Or does it only work on one person's laptop?
Where changes go. Is there a test version where changes are checked first, or does every change go straight to customers?
The data. Where customer data lives, who can see it, and whether there are backups. And whether anyone has ever restored one.
Passwords and keys in the code. Surprisingly common, and an easy way to get hurt.
The parts that touch money. Payments, billing, anything a customer is charged for. Those need to be right before anything else.
Then I read the code.
Within the first hour or two I can usually tell a founder whether to keep it, fix it, or rebuild it. The rest of the review is about how much work each part is, so the next step has a real number on it.