Discipline

The Pre-Production Hardening Checklist

The last pass before public traffic — secrets, RLS, headers, limits, legal.

PRE-PRODUCTION-HARDENING-CHECKLIST.md · 19 sections · 1,990 words · 13 KB · markdown

A line-by-line checklist to run in launch week. Secret hygiene and rotation, row-level security coverage, security headers, rate limits on anything that costs money, a Core Web Vitals baseline, and the legal pages you can't launch without.

What's inside

//Secret audit + rotation checklist (including anything shown on stream)
//RLS coverage verification, table by table
//Security header and CSP baseline
//Rate limits on every endpoint that spends money
//Core Web Vitals baseline capture
//Legal page checklist
//The anti-pattern list that catches most launch-day incidents

When to use it

Launch week, before public traffic.

Build these first

Nothing. This one stands alone.

Straight from the file

Portable across any Next.js + Supabase + Vercel + Trigger.dev SaaS. Built from the BKE / Kompozy launch sequence. Reference repo: reference app.

Table of contents

0. Use this checklist
1. Secrets audit
2. Auth + edge gating
3. RLS verification
4. Security headers
5. Rate limiting
6. Webhooks
7. Database hygiene
8. Email auth
9. Error monitoring
10. CWV baseline
11. Customer-facing legal
12. SEO + GEO baseline
13. Domain + DNS
14. Deploy verification
15. Smoke tests (run after deploy lands)
16. Documentation
Common pitfalls
Kickoff prompt

How to run it

Drop PRE-PRODUCTION-HARDENING-CHECKLIST.md into your repo, then tell Claude Code: “Read PRE-PRODUCTION-HARDENING-CHECKLIST.md and implement it in this codebase.” It's written for an agent to execute end to end. Search the file for angle-bracket placeholders and swap in your own project names, domains, and keys before the first run.

↓ Download the playbook

More discipline playbooks

C-tier

← All 28 Claude templates

The Pre-Production Hardening Checklist

Supabase Migrations

Core Web Vitals Audit

AI Compliance Gate