Production Readiness Checklist

Sign in to save your progress across devices. Until then it is kept in this browser.

Every item needs evidence (a link to a test run, scan, screenshot or log). "The AI said so" is not evidence.

Gate 1: DO NOW (before real users, data or money) → L1 Vibe Builder

Security

• Every table has Row-Level Security / tenant scoping; tested that user A cannot read or write user B's dataEvidence
• Authorization checked server-side on every endpoint and objectEvidence
• Zero secrets in git history or frontend bundle (gitleaks + bundle search)Evidence
• Spend caps on every paid API (LLM, SMS, email, maps)Evidence
• Rate limits on login, sign-up, reset, OTP and costly endpointsEvidence
• Proven auth provider; secure cookies; MFA available for adminsEvidence
• Parameterised queries only; output escaped; CSP setEvidence
• SSRF protection on any URL-fetching featureEvidence
• CORS allowlist; CSRF protection with cookie authEvidence
• TLS everywhere including DB connections; HSTSEvidence
• Encryption at rest on DB, storage and backupsEvidence
• Errors fail closed; no stack traces to usersEvidence

Correctness and data

• DB constraints enforce key invariantsEvidence
• Indexes on filtered/joined columns; no N+1 on main pagesEvidence
• Connection pooling for serverlessEvidence
• Idempotency on payments, orders and every external side effectEvidence
• Concurrency test on money/inventory pathsEvidence
• All schema changes via versioned migrationsEvidence

Reliability

• Timeout on every outbound callEvidence
• Retries only on transient errors, with backoff and jitterEvidence
• Webhooks: signature verified, deduped, processed asyncEvidence
• Cron jobs idempotent and monitoredEvidence

Shipping and operations

• CI runs lint, types, tests, scans on every PR; main is protectedEvidence
• Lockfile committed; new dependencies verified to exist and be maintainedEvidence
• Rollback proven in under a minuteEvidence
• Health check endpoint; uptime monitorEvidence
• Structured logs with request IDs, no secrets/PIIEvidence
• Alerts on error rate, spend spikes, and downtimeEvidence
• Automated backups + one successful restoreEvidence
• CDN in front of static assets; DNS records documentedEvidence

AI features

• No agent holds production credentialsEvidence
• Human approval on every irreversible or external agent actionEvidence
• LLM output treated as untrusted inputEvidence
• Token budgets and max steps per runEvidence

Legal

• Privacy notice; consent recorded; data export and deletion pathsEvidence
• Breach response checklist with notification timelinesEvidence

Gate 2: GROWTH (paying customers, team, or unattended traffic) → L2 Vibe Engineer

• Caching with explicit invalidation; no private data in shared cachesEvidence
• Background job system with DLQ and replayEvidence
• Circuit breakers and fallbacks on critical dependenciesEvidence
• Liveness vs readiness probesEvidence
• OpenTelemetry tracing across API, queue, worker and LLMEvidence
• SLOs on critical journeys with burn-rate alerts and runbooksEvidence
• Feature flags; rolling deploysEvidence
• Expand-and-contract migrationsEvidence
• API versioning + deprecation policy; OpenAPI contract testsEvidence
• JWT rotation / short-lived tokens; SSO for enterprise customersEvidence
• WAF and bot protectionEvidence
• Infrastructure as codeEvidence
• SBOM + dependency and container scanningEvidence
• Eval and red-team suites for LLM features in CIEvidence
• Audit log for admin and agent actionsEvidence
• RPO/RTO defined; PITR; immutable off-account backups; quarterly restore drillEvidence
• On-call, incident process, status page, postmortemsEvidence
• Load-tested capacity documentedEvidence
• Cost per user and per AI task trackedEvidence

Gate 3: SCALE / ENTERPRISE → L3 Enterprise Vibe Architect

• Canary or blue-green with automated analysisEvidence
• Read replicas with read-your-writes strategyEvidence
• Table partitioning for high-volume dataEvidence
• Autoscaling with tested limitsEvidence
• Multi-zone HA; DR plan for region/provider loss, testedEvidence
• Chaos game days scheduledEvidence
• Error budget policy agreed with the businessEvidence
• SOC 2 Type II or ISO 27001 programme with continuous evidenceEvidence
• AI register and governance mapped to IMDA MGF / ISO 42001 / NIST AI RMFEvidence
• Sector rules addressed (e.g. MAS TRM for fintech)Evidence
• Trust package ready for procurementEvidence