A 22-point check before launch

Six parts, in the order apps break: secrets, database access, auth, routing, payments, monitoring. Each point links to the guide or tool that fixes it.

0 of 22 done

Ticks stay in this tab only: nothing is stored or sent. Print the page to keep a copy.

Part 1 of 6

Secrets and keys

No secret keys in browser code. Anything prefixed VITE_ or NEXT_PUBLIC_ is public. See the fix
Scan the whole git history for leaked keys before making the repo public, and rotate anything found. See the fix
GitHub push protection is on, so new secrets get blocked at push time. See the fix
Production environment variables are set in your host dashboard, then redeployed. See the fix

Part 2 of 6

Database and data access

Row Level Security is enabled on every Supabase table the browser can reach, with one policy per operation. See the fix
The service_role / secret key is only used server-side. See the fix
You know your free-tier limits (storage, pausing, compute hours) and what happens when you hit them. See the fix
You have a backup plan. Several free tiers include no automatic backups. See the fix

Part 3 of 6

Auth

Site URL and Redirect URLs point at your production domain, not localhost. See the fix
You tested sign-up, email confirmation, password reset and logout on the live URL. See the fix
OAuth providers (Google, GitHub) list the production callback URL. See the fix

Part 4 of 6

Hosting and routing

Deep links and page refreshes work. SPAs need a rewrite to index.html. See the fix
Your server listens on 0.0.0.0 and the port your host expects (Replit, Render). See the fix
Your host's free plan allows your use case. Vercel Hobby is non-commercial, for example. See the fix
You have a custom domain with HTTPS, or you are happy with the free subdomain for now. See the fix

Part 5 of 6

Payments

You decided whether you need a merchant of record to handle sales tax and VAT for you. See the fix
Webhooks point at production and verify signatures. Test mode is off in production. See the fix
You ran a real end-to-end purchase and refund on the live site. See the fix

Part 6 of 6

Monitoring

An uptime monitor emails you when the site goes down. See the fix
Front-end and back-end errors are reported to an error tracker. See the fix
Dependencies were scanned for known vulnerabilities. See the fix
Basic analytics so you know if anyone uses it. See the fix