# Stay safe

What to check your AI did, in plain words.

Your app handles real COHO data for your organisation. AI tools are good at writing code, but they don't always follow every rule. These are the checks that matter most. Ask your AI to confirm each one, or use the security review prompt in [Prompts to copy](../prompts/#check-its-safe).

## You approve every change

Your AI can create and update apps on COHO, but it must **show you a preview and wait for your yes** first. Never let it confirm on its own. If it does, stop and check what it changed.

## Your app checks that messages really come from COHO

Every message COHO sends your app (apart from the health check) carries a signature. Your app must check it and reject anything that doesn't match. Getting this wrong is a security hole, not just a bug. The spec includes test values for this, and your AI should show you the checks passing against them.

## Secrets stay secret

When your app is connected, COHO gives it an API key and a signing secret.

- They must **never** appear in a link, a URL or a log.
- Never paste them into a chat, an email or a support request.

## Your panel only opens inside COHO

If your app has a panel, it must tell browsers it can only be shown inside COHO (`frame-ancestors` listing COHO's addresses, never `*`).

## Ask for only what you need

Your app's manifest lists what it wants to do in COHO (its *capabilities*). Only request what it actually uses. Some areas, such as messaging tenants or rent payments, need extra approval from a manager.

## Clean up when disconnected

When a manager disconnects your app, it must delete the data it was holding for that organisation.

## Keep it private until it's checked

Apps you build are private to your organisation. Listing one publicly in the COHO Store requires passing a quality check, so have a developer review it first. See [When to bring in a developer](../get-help/#when-to-bring-in-a-developer).