Your app handles real COHO data for your organisation. AI tools are good at writing code, but they don’t always follow every rule. These are the checks that matter most. Ask your AI to confirm each one, or use the security review prompt in Prompts to copy.
You approve every change
Section titled “You approve every change”Your AI can create and update apps on COHO, but it must show you a preview and wait for your yes first. Never let it confirm on its own. If it does, stop and check what it changed.
Your app checks that messages really come from COHO
Section titled “Your app checks that messages really come from COHO”Every message COHO sends your app (apart from the health check) carries a signature. Your app must check it and reject anything that doesn’t match. Getting this wrong is a security hole, not just a bug. The spec includes test values for this, and your AI should show you the checks passing against them.
Secrets stay secret
Section titled “Secrets stay secret”When your app is connected, COHO gives it an API key and a signing secret.
- They must never appear in a link, a URL or a log.
- Never paste them into a chat, an email or a support request.
Your panel only opens inside COHO
Section titled “Your panel only opens inside COHO”If your app has a panel, it must tell browsers it can only be shown inside COHO (frame-ancestors listing COHO’s addresses, never *).
Ask for only what you need
Section titled “Ask for only what you need”Your app’s manifest lists what it wants to do in COHO (its capabilities). Only request what it actually uses. Some areas, such as messaging tenants or rent payments, need extra approval from a manager.
Clean up when disconnected
Section titled “Clean up when disconnected”When a manager disconnects your app, it must delete the data it was holding for that organisation.
Keep it private until it’s checked
Section titled “Keep it private until it’s checked”Apps you build are private to your organisation. Listing one publicly in the COHO Store requires passing a quality check, so have a developer review it first. See When to bring in a developer.