← All PostsSep 7, 2026

Production Checklist

Six checks

An app is ready when all six are true:

You see failures. Errors, logs, uptime, and an alert that wakes you.
You can undo. Tested backups, safe migrations, rollback in one minute.
Strangers stay out. Hardened auth, no secrets in the repo, rate limits, security headers.
People find it. Domain, metadata, OG image, sitemap, search engines allowed.
Money flows. Live keys, verified webhooks, spend caps on each metered service.
The law is met. Privacy policy, terms, data deletion, a contact address a human reads.

Assumptions

Next.js on Vercel or Cloudflare. Postgres behind a pooler. Third-party email, payments, and error tracking.

The platform handles these. They are not on the list:

TLS and the HTTP to HTTPS redirect
DDoS mitigation (Vercel Firewall, Cloudflare WAF)
CDN cache for static assets
Rollback to a previous deployment
Trailing-slash redirect (Next.js default)

Copy the list into docs/launch.md in each project. Delete lines that do not apply. Tick with a date.

Before the first user

Domain

Email

SPF, DKIM, DMARC (p=quarantine or stricter) on the sending domain
Transactional on mail., marketing on news.. Separate reputations
Each template checked on mobile and in dark mode
Reply-to goes to an inbox a human reads
One-click unsubscribe on all marketing email

Auth and security

Data

Daily backups on. Point-in-time recovery on if available
One backup restored to a scratch database. One row read
Migrations run in CI against a copy of the production schema
Drop and rename done as expand, migrate, contract. Never one step
Index on each foreign key. EXPLAIN on the three heaviest queries
Pooler URL in production, not the direct URL
Database in UTC. Convert at the edge only

Observability

Money

Payment provider in live mode. Test keys removed from production env
Webhook signatures verified. One live event replayed
Webhook handlers idempotent. Same event twice grants once
Spend cap or budget alert on each metered service: AI gateway, email, database, storage, maps
Hosting spend capped. Vercel: Spend Management with hard pause. Cloudflare: billing alert plus a per-request limit in the Worker. No hard cap exists
Failed payment and cancellation tested with a real card. Refunded
Legal entity name and address on receipts

Legal

Terms, privacy, refund, and cancellation policies forked from 37signals policies (CC BY 4.0, plain English, SaaS shape). Cookie policy and DMCA from Automattic Legalmattic (CC BY-SA) if needed. Keep the attribution line
docs/legal-facts.md written before the fork is edited. The policies are rewritten from these facts, not from guesses. See the list below
Each policy read once against the product. Every sentence that describes a feature, vendor, data flow, or refund rule the product does not have is deleted or changed
Policies live in pages/legal/ as Markdown. Effective date at the top. Changes go through git, so the history is the audit trail
Privacy policy and terms linked from footer and signup
No cookie banner by default. Session cookie plus cookieless analytics need no consent under GDPR or ePrivacy. Say so in the privacy policy
Before any marketing pixel or session replay: add c15t (npx @c15t/cli). Open source, Next.js native, Google Consent Mode v2 built in. Hosted mode, free tier, so the backend detects the visitor’s jurisdiction. Pixel fires after opt-in only. Check the network tab with overrides: { country: 'DE' }
Account deletion by the user. Deletes or anonymizes all data. Tested
Contact address on the site. A human replies within one day

legal-facts.md

# Legal facts
 
## Entity
- Legal name, country, address
- Contact email for privacy requests
- Governing law and venue
 
## Product
- What the product does, one sentence
- Who can sign up (age minimum, business only, regions excluded)
- Free tier, trial length, what happens when it ends
 
## Money
- Billing period, currency, tax handling
- Refund rule (none, 14 days, prorated)
- Cancellation: who can cancel, when it takes effect, what happens to data
 
## Data collected
- Account: email, name, ...
- Usage: events, logs, IP, ...
- Content: files, messages, ...
- Payment: handled by <vendor>, card data never touches us
 
## Vendors that see user data
- Hosting, database, email, analytics, error tracking, AI, payments, support
- For each: vendor name, what it sees, region
 
## Retention
- Active accounts: kept while the account exists
- Deleted accounts: purged within N days
- Backups: N days
- Logs: N days
 
## AI
- Is user content sent to a model? Which vendor? Used for training? Opt-out?
 
## Cookies
- Session cookie only, or list the others and their purpose

Launch day

Deploy from a git tag. Tag = release
Incognito, on a phone: new account, core action, logout
Sentry open for the first hour
OG preview checked on the platform you post to
Post. Then do not touch production for the day unless it is down

First week

Read each error once. Fix or mute it
Look at the 5 slowest routes and the 5 slowest queries
Read the first support emails yourself
Compare each bill to its cap
Check backup timestamps. One per day
Each monitor below shows data
Add what you forgot to this list

Audits

All free. One tool per job. Run before launch and after any change to routes, metadata, headers, or email. Record scores in docs/launch.md.

Cache headers in one command

for u in / /pricing /app /api/me; do
  echo "== $u"
  curl -sI "https://example.com$u" \
    | grep -i -E '^(cache-control|age|x-vercel-cache|cf-cache-status|vary|set-cookie):'
done

Monitors

Set up once, before launch. Each needs domain verification. Do them in one sitting.

Turn checks into gates

Each item you automate leaves the list. Automate these:

Headers, redirects, robots.txt, metadata: smoke test against the preview URL in CI
Secrets in the repo: pre-commit secret scanner
Migration drift: pre-push check. Schema changed with no migration fails
Backups: monthly job restores to a scratch database and counts rows
Missing FK indexes: schema lint in CI
Auth: integration test of the OTP flow against the preview deployment
Lighthouse CI and npx ax audit in the deploy pipeline. Fail on regression from the baseline

Keep these manual:

The first backup restore
The first errors and support emails
The OG preview on the real platform
The incognito phone walk-through

These show what the list is missing. When production breaks on something a line here would have caught, add the line the same day.

Insecure direct object reference. The query filters by id but not by id AND owner_id. Each list, detail, update, and delete needs the owner in the WHERE. ↩

#Six checks

#Assumptions

#Before the first user

#Launch day

#First week

#Audits

#Monitors

#Turn checks into gates

#Footnotes