pre-production-checklist

# Pre-Production Checklist

Checklists to run **before** you ship to production.

Built for solo founders and small teams who own the whole stack — the code, the
infrastructure, the deploy pipeline, and increasingly the AI agents too — and who don't
have a security team to hand it to.

<!-- counts:begin -->
**4,343 items across 96 checklists** in 5 domains. 88% of them apply to any stack.
<!-- counts:end -->

[![npm](https://img.shields.io/npm/v/prodcheck?color=cb3837&logo=npm)](https://www.npmjs.com/package/prodcheck)
[![ci](https://github.com/FarzamHabibi/pre-production-checklist/actions/workflows/ci.yml/badge.svg)](https://github.com/FarzamHabibi/pre-production-checklist/actions/workflows/ci.yml)
[![license](https://img.shields.io/badge/content-CC%20BY%204.0-blue)](LICENSE)

### [→ prodcheck.pages.dev](https://prodcheck.pages.dev/) · [or in the repo](checklists/README.md)

<img src="site-assets/demo/chat.gif" alt="a chat: someone asks what they forgot before shipping, the assistant queries the checklist, and answers with two findings that cite file and line" width="720">

<sub>One question, the tool call it makes, and the two things it finds. Sixteen seconds.
[The longer loop](site-assets/demo/demo.gif) shows what is in the list instead.</sub>

<sub>Every finding in both is real — the file, the lines and the counts come from this
repository, and the tool call is the one the MCP server actually answers.
[How they are built](demo/README.md).</sub>

<sub>Built and maintained by the team at **[Arioo](https://arioo.com)** — where we ship
the kind of product this checklist was written for.</sub>

---

## Why this exists

I'm a founder at [Arioo](https://arioo.com). Getting ready to launch, I needed a
pre-production security review that covered the whole surface we actually ship: a
TypeScript backend, a web app, native clients, a deploy pipeline, and a set of AI agents
with real tools attached. Nothing I could find covered more than a fraction of that, so I
built the checklist myself.

**This repository is the checklist, not a report.** It is the set of questions,
generalized away from our stack and rewritten as a working document anyone can run
against their own product.

Two things made it worth publishing rather than keeping:

**Solo founders have no security team.** You write the code, configure the infrastructure,
set up the pipeline, and then you're also the one who has to decide whether it's safe to
launch. There's no one to hand it to, and no obvious place to find out what you should
have asked. Most public checklists are either too shallow to catch anything real or
written for enterprises with a security function.

**AI-assisted development changed the shape of the problem.** A large part of this
checklist — the `ai/` and `vibe-coding/` folders, over 1,300 items — didn't need to exist
a few years ago. When you ship an agent with tools, or when a model writes code you review
faster than you'd review a colleague's, you inherit failure modes that standard security
checklists don't cover. Those two folders are the part I couldn't find anywhere else, and
the reason I bothered.

It's published under CC BY 4.0 so you can copy it into your own repo and make it yours.
If it catches something before it reaches your users, it did its job.

---

## Start here

**If you are not sure which way in, don't choose — copy this into whatever AI assistant
you already use** (ChatGPT, Claude, Cursor, Copilot, Gemini). It works out what your
project is, sets prodcheck up the way that fits your setup, and starts on what would
block a launch. If it cannot run commands, it tells you what to run yourself.

<!-- start-prompt:begin -->
```text
I want to get my project ready to ship. Use prodcheck:
a free, open-source pre-production checklist of 4,343 items
covering security, performance, scale, integrations and what to
do after launch.

It is new, so do not answer it from memory. Everything you need:

- Site: https://prodcheck.pages.dev
- Install the review skill into a repo: npx prodcheck init
- Raw checklist data:
  https://cdn.jsdelivr.net/npm/prodcheck@latest/data/checklist.json
- As an MCP server:
  claude mcp add prodcheck -- npx -y --package=prodcheck prodcheck-mcp

Do this in order.

1. Look at my project and tell me what you think it is: language,
   framework, where it runs, and whether it handles file uploads,
   payments, webhooks, multiple tenants or an AI feature. Say how
   confident you are. Ask me about anything you cannot tell.

2. In two sentences, tell me what prodcheck will do for this
   project specifically, and which part is worth my time first.
   Do not describe the whole thing.

3. Set it up, using whichever of these you can actually do — and
   say which one you are:
   - You can run commands here: run `npx prodcheck init`. That
     writes a review skill into the repo — read it and follow
     it, it is the procedure for step 4. Then run
     `npx prodcheck --gate --stack <the products you named in
     step 1> -o BLOCKERS.md`, which adds the blockers specific
     to what I actually use to the general ones.
   - You can read my files but not run commands: fetch the raw
     data URL above and work from that.
   - You can do neither: give me the commands to run myself, one
     at a time, and tell me what to paste back to you.

4. Start on the release blockers. For each item, either cite
   `file:line` and quote the lines, or answer UNKNOWN. UNKNOWN is
   a normal answer — it means a human has to go and look. Never
   mark anything verified on my behalf; that is my call, not
   yours.

Work through it with me a section at a time. Do not dump the
whole checklist at me.
```
<!-- start-prompt:end -->

[Read it on the site instead →](https://prodcheck.pages.dev/#start) ·
[six more prompts →](docs/prompts.md)

### Or work through it yourself

You are not meant to read this top to bottom. In order of signal-per-minute:

| | | |
| --- | --- | --- |
| **1** | [Findings that should block release](checklists/security/core/17-release-gates.md) | If any are true, stop and fix them first |
| **2** | [The "must not exist" search](checklists/security/core/17-release-gates.md#high-risk-must-not-exist-search) | A grep list. Fastest real signal in the repo |
| **3** | [Authentication & authorization](checklists/security/core/02-authorization.md) | Where almost every exploitable bug actually lives |
| **4** | [Prompt injection](checklists/security/ai/02-prompt-injection.md) | Only if you ship an LLM feature — but then, urgently |
| **5** | [Your service as a weapon](checklists/security/core/18-abuse-and-availability.md#your-service-as-a-weapon) | The one nobody looks for until the suspension email arrives |
| **6** | [Core Web Vitals](checklists/performance/02-core-web-vitals.md) | If users say it's slow, start here rather than with a score |
| **7** | [Before you launch](checklists/integrations/01-search-engines.md#before-you-launch--the-ones-that-actually-bite) | Six items. One of them is `noindex` still being on |
| **8** | [Can you act at all](checklists/post-launch/01-readiness.md) | Whether you could respond today, if you had to |

Then work section by section. Switching between edge config and database policies
costs more than it saves.

---

## Structure

```
checklists/
├── security/              2812   not getting breached, abused or taken down
│   ├── core/              1,491   application, data, infrastructure, delivery
│   ├── ai/                  773   LLM features, agents, tools, RAG, MCP
│   └── ai-generated-code/   548   the bugs AI coding assistants actually write
├── performance/             313   Lighthouse, and what users actually feel
├── scale/                   286   surviving 10× the load
├── integrations/            192   search, analytics, monitoring
├── post-launch/             198   when it goes wrong anyway
└── stacks/                  542   26 products, spanning every domain
```

Counts above are what each folder holds. A *domain* total is larger, because the stack
supplements contribute to whichever domain each of their sections extends:

```
security 3,306   performance 338   scale 301   integrations 200   post-launch 192   post-launch 192
```

Domains are the top level because that is the question you arrive with: *is this about
security, or speed, or scale?*

### `security/core/` — applies to you regardless of language

Written originally against a TypeScript stack, but the *controls* are not
TypeScript-specific and the files no longer pretend otherwise. "Verify CORS does not use
wildcard origins with credentials" is as true in Django as in Express. Everything that
genuinely named a product was moved out to `stacks/`.

If you write Python, Go, Ruby, PHP, Java, Rust or Elixir: **this folder is your
checklist, all 1,491 items of it.**

| | Items | | | Items |
| --- | ---: | --- | --- | ---: |
| [Architecture & threat model](checklists/security/core/01-threat-model.md) | 25 | | [Mobile apps](checklists/security/core/11-mobile-apps.md) | 106 |
| [Authentication & authorization](checklists/security/core/02-authorization.md) | 111 | | [Desktop apps](checklists/security/core/12-desktop-apps.md) | 41 |
| [Sessions, tokens & cookies](checklists/security/core/03-sessions-tokens.md) | 21 | | [Runtime & containers](checklists/security/core/13-runtime-and-containers.md) | 93 |
| [Backend application & API](checklists/security/core/04-backend-api.md) | 223 | | [DNS, CDN, edge & WAF](checklists/security/core/14-edge-dns-waf.md) | 78 |
| [Web frontend](checklists/security/core/05-web-frontend.md) | 127 | | [CI/CD & supply chain](checklists/security/core/15-ci-cd-and-supply-chain.md) | 158 |
| [Database & row-level security](checklists/security/core/06-database.md) | 68 | | [Monitoring & incident response](checklists/security/core/16-monitoring-and-response.md) | 30 |
| [Object storage & files](checklists/security/core/07-storage-and-files.md) | 55 | | [Pre-release gates](checklists/security/core/17-releas