Ruthless.

Novice · Launch and run · 6 min read

Use Ruthless to check your app after a change goes live

Learn what to inspect after launch, how to ask for safe diagnostic evidence and why a backup needs a real restore check.

← All guidesNovice guidesBy Ruthless AI team

Learn by using GetRuthless

Keep this guide beside your Ruthless chat. Copy one prompt, add the example it asks for and paste it into “Message Ruthless”. Nothing is sent until you choose to send it.

Open Ruthless in another tab ↗More in Launch and look after itNew to this? Start here

The short answer

After a change, follow a real new-user journey, inspect the resulting saved data and ask your builder about errors around that journey. Keep a recoverable previous version and prove a backup can be restored in a separate private copy. Use Ruthless to interpret redacted evidence, not to assume it has inspected your live app.

Start with the journey the change could affect

Launching means making your app available to users. It does not freeze its behaviour: later code, settings and service changes can alter a journey that worked yesterday. Write down what changed and which real action could be affected. If you changed a booking form, inspect creating a booking, its confirmation and the saved booking details rather than checking only that the homepage opens.

A new user has no saved session or previous setup to help them. A session is the browser’s remembered signed-in state. Ask your builder or tester to use a fresh browser profile and a company test account, then walk through discovery, sign-up, first useful action and returning later. Use fake personal information and a payment provider’s test mode where payment is part of the exercise.

Turn the change into a GetRuthless check plan

Open chat, inspect Choose model and select an available model suited to interpreting the change. Give the intended behaviour and observed result. Redacted means replacing secrets and personal information before sharing. Ruthless can organise the evidence and suggest missing observations, but it cannot infer the live result from a release announcement.

If someone says “check logs”, ask them to be specific. Logs are timestamped records of events and errors. Ask your builder where this app’s hosting service displays them, how to narrow them to the test time and which entries match the booking request. Have them return a short explanation with keys, login cookies, addresses and customer details removed, not a complete raw export.

Try this prompt
Help me check my own booking app after a form change. Change: added an optional “access instructions” field. Expected: a new fake user can sign up, book once, see a confirmation and reopen the booking with that field saved. Observed: the confirmation appeared, but the field was blank on reopening. You cannot access my app. Give my builder the smallest checks to distinguish a screen-display problem from a saving problem, the exact evidence to return and the related existing journey to recheck. Explain any technical words. Do not call this fixed without a repeat of the original journey.

Know how you would recover before you need to

A previous code version can restore old behaviour, but it may not recover deleted data. A backup is a saved copy of data or files. A restore test loads that copy into a separate private environment and proves a known fake record can actually be read. Ask what is backed up, how recent the copy is and who can perform the recovery. General security testing guidance treats these operational checks as part of understanding the system. [1]

For a real example, create a fake booking named RECOVERY-SAMPLE before a planned backup test. Have the builder restore into the separate copy and open that booking there. Record whether its date and access instructions match. Never paste a database backup into chat: it may contain private records and credentials. If a change alters how data is stored, ask whether the previous code can still read that data before relying on a simple switch back.

Keep a short, honest after-change note

Use three sentences: what changed; which new-user journey actually completed; what remains untested and who owns it. For the example, a useful final result says the optional field was saved and shown after reopening, with the original booking journey still working. “Deployed successfully” alone proves neither.

Your exercise is to ask Ruthless to rewrite your last change note into checkable statements. Replace “Everything works” with specific actions and read-backs. Keep an unavailable check visible rather than asking the model to fill the gap with reassurance. Secret replacement is also ongoing work if credentials were exposed; use the issuing service’s controls rather than merely hiding the old value. [2]

Common questions

Does a working homepage prove the update is good?

No. Follow the affected journey and inspect its saved result, including the experience of a new test user.

Does having a backup prove recovery works?

No. A restore into a separate private environment is needed to show the saved copy is usable.

Sources & further reading

  1. OWASP Web Security Testing Guide
  2. OWASP Secrets Management Cheat Sheet

The example prompts and workflows are GetRuthless guidance. Source references support the concepts explained; they are not an endorsement of GetRuthless.

Put the guide into practice.

Open Ruthless and choose an available standard or abliterated model suited to your task. Copy a prompt above, add the context it asks for and check the result. You can compare models in the same workspace; see current pricing before sending requests.