ShipSafe · Checks

All 23 checks

The full pre-deploy checklist, grouped by section. Each page has the fix steps and a way to verify.

Secrets and .env

  1. Keep .env files out of git
  2. No secret keys in the browser bundle
  3. Rotate leaked keys, don't just delete them
  4. Turn on secret scanning

Auth and database

  1. Enable Supabase RLS on every table
  2. Keep the service_role key on the server
  3. Check permissions on the server
  4. Keep storage buckets private unless they must be public
  5. Treat user and AI input as untrusted

Payments

  1. Verify the Stripe webhook signature
  2. Keep Stripe test and live keys apart
  3. Decide prices and access on the server

Abuse and cost

  1. Rate limit expensive and auth endpoints
  2. Cap your AI spend
  3. Set billing alerts on every paid service
  4. Add bot protection to public forms
  5. Make LLM features resist prompt injection

Deploy

  1. Set Vercel environment variables per environment
  2. Log errors without logging secrets
  3. Have backups and test a restore
  4. Keep previews away from production data
  5. Check every package your AI added
  6. Don't leave debug, admin or test routes public

Open the interactive checklist