Writing · Safety by design and operations

Launches get a security review. Almost none get an abuse review.

Most product launches get a security review. Almost none get an abuse review: who will misuse this, how, and what do we ship on day one to stop it.

So I built a free tool that does one in about three minutes.

You answer 12 plain questions about what you're building and who uses it.

It gives you:

→ The abuse risks that apply, rated by how severe and how likely

→ The safeguards to ship before launch, with an owner for each, in priority order

→ The laws that likely apply in your markets

→ A launch plan you can send straight to Jira, Linear or GitHub

It runs in your browser. Nothing you type leaves your device. (Unless you opt-in to Claude functionality on some tools)

No sign-up.There are worked examples for a marketplace, a dating app, a teen social app and a few others if you'd rather look before you answer anything.

Its part of a larger project Ill share more of soon. For now Id like to know where this one is wrong: which risks are missing, which safeguards are naive, what a real launch review would ask that this doesn't.

Link in the first comment.

Related

  1. Run the abuse pre-mortem at design review

    At design review, changing a default is a quick edit. After launch it means taking something away. T&S earns the invite by being selective and fast, and accepted risks get an owner and a date.

    1 min read · Essay · Safety by design and operations

  2. You can't moderate your way out of a systems problem

    Treating Trust & Safety mainly as an operations function is a mistake. Reputation, history, age and behavior signals belong in one risk model, automation needs clear limits, and safety belongs in the product architecture from the start.

    1 min read · Essay · Safety by design and operations

  3. What I'd tell myself in year one of Trust & Safety

    Five lessons from more than ten years in the field: treat safety as a systems problem built into the product, don't treat a ban as a closed case, measure what users experience rather than how busy the team was, let automation earn its scope, and give every risk one named owner.

    1 min read · Essay · Safety by design and operations