Before you tell anyone about it

I'm about to share this publicly. Stack: <stack>, live at <url>.
Here's the code: <paste or describe>

Go through it as the first stranger to arrive:
- Does it work on a phone, on a slow connection?
- What happens with unexpected input, or none?
- Any key, path or internal error message exposed?
- Can I read another user's data by changing an ID?
- Is anything unmetered that costs me money per call?
- Does a refresh or a back button lose someone's work?
- Do I find out if it breaks at 3am?
- What's the rollback if this goes badly?

Rank findings by how embarrassing they'd be, worst first.