Secure the data first
Database access rules, authentication, and secrets are the items that leak customer data or money. Verify Row Level Security, server-side route protection, and that no keys ship in the client bundle before anything else.
Vibe-coded app production checklist
The launch checklist for a vibe-coded app.
A vibe-coded app that demos well can still fail in production. This checklist covers what changes when real users arrive: data access rules, deployment and rollback, monitoring, scale, dependencies, and who owns the code and infrastructure.
What should a production checklist cover?
Make failure recoverable
Production means things break. Confirm there is a rollback path for a bad deploy, error monitoring that alerts you, and that a failed payment or API call does not corrupt state.
Plan for scale and ownership
Check that the database and hosting can handle expected load, that dependencies are current, and that someone clearly owns the codebase, the accounts, and the infrastructure.
The full production checklist
If any item near the top is unchecked, the app is not ready for paying customers.
- Database access rules prevent cross-user and cross-tenant reads and writes.
- Authentication and roles are enforced server-side on every protected route.
- No secrets in the client bundle; production secrets live in environment variables.
- Deploys are repeatable and a previous version can be restored quickly.
- Database migrations are versioned and reversible.
- Errors and downtime are monitored and alert a human.
- The app handles bad input, failed payments, and third-party outages without corrupting data.
- Expected traffic and data volume have been considered against the hosting plan.
- Dependencies are current and free of known critical vulnerabilities.
- Ownership of code, domains, and cloud accounts is documented.
Use the production readiness review to confirm these items, and the productionize roadmap to fix them in the right order.
Related guides
AI-built app security checklist
The security-specific items to verify before launch.
Review vs automated scan
Why an automated scan alone will not clear this checklist.
Sample written review
An anonymized deliverable showing how these items get checked.