Security Checklist for Midnight dApps Before Deployment

A Midnight DApp can pass local unit tests and still leak data, accept replayed actions, or fail proof generation in the target environment. The risk comes from the parts that make Midnight powerful: selective disclosure, witness functions, private state, ZK proofs, and a toolchain that spans Compact, generated JavaScript, Midnight.js, the wallet SDK, the indexer, and the proof server. This checklist gives you a repeatable predeployment review. It focuses on seven release gates: Audit disclose()