app-verifylisted

# App Verify Verify a running or deployed web app by operating it, not by reading its source. The highest-value bugs are the ones that pass the typechecker and return HTTP 200 but are still wrong: a form that saves nothing, a report built on a column no code writes, a stat card with a hardcoded number. Source review and unit tests routinely miss these. Driving the real app in a browser and checking the datastore underneath is how you find them. Two modes, often run together: - **Sweep** — go through every route/flow as a user, find what's broken or fake. - **Deploy-verify** — confirm a build/commit/deploy actually shipped and the live app is healthy. **Stack-agnostic.** The method is the same for any framework, language, and datastore. Concrete commands below use one stack (Next.js + Supabase/Postgres) as a worked example — translate each to yours: the route list comes from your router, the "database" is your authoritative store (SQL, NoSQL, an API), and the "direct read" is whatever client reaches it (psql, an ORM console, a Mongo shell, the provider's dashboard or API). Where you see a Postgres/Supabase term, read the principle, not the brand. ## Security & credentials This skill stores no secrets — it's instructions, nothing else. Two steps touch credentials, and both stay inside the operator's own machine: - **Session cookie** — the route sweep reuses the already-logged-in browser session by reading its cookie (`document.cookie`) to make authenticated `curl` reques