This checklist covers the launch work that changes for Bolt, Firebase, and Stripe. It uses fixed rules and gives you direct prompts before you publish.
Defaults for the remaining questions
Auth: Email code. AI features: No. Customer data: Personal data. Hosting: Other.
Preview and production can return different routes, headers, and environment values.
Fix prompt
Plain http requests to this app do not redirect to https. Turn on the force-https option in your hosting dashboard, or add a permanent redirect at the server. Verify with curl -I on the http address.
A working first screen does not prove the main task completes.
Fix prompt
Run the main user journey from a clean browser. Record each request, state change, failure path, and final result.
Hidden buttons do not stop a direct request to a protected action.
Fix prompt
List every protected read and write. Enforce identity and ownership on the server for each one, then test a second account against them.
Browser validation can be skipped by direct requests.
Fix prompt
Add strict server-side validation and length limits to every public or authenticated mutation. Return clear errors without internal details.
Anyone who opens the page can read this key and use it directly against the service it belongs to, with your account paying for it.
Fix prompt
A server-side secret ({pattern}) is inside the JavaScript sent to browsers. Rotate it at the provider now, move the code that uses it to your server, and remove it from any frontend environment variable.Timeouts and rejected requests need a truthful, recoverable interface.
Fix prompt
Force the main external request to time out and fail. Show a truthful error, preserve user input, and provide a retry that cannot duplicate work.
Whether you can put the previous version back, and how long that takes.
A URL cannot verify this. A Launch Review can.
Fix prompt
Deploy a trivial change, then roll it back, and time how long the app is wrong for.
Whether a failure in production reaches a human rather than sitting in a log nobody opens.
A URL cannot verify this. A Launch Review can.
Fix prompt
Trigger a deliberate error in production and see whether anything alerts you within five minutes.
Whether a script can hammer your forms, sign up loop, or paid endpoints without being slowed down.
A URL cannot verify this. A Launch Review can.
Fix prompt
Send the same form fifty times in a minute from one address and see whether anything stops you.
Stripe can deliver the same event more than once.
Fix prompt
Verify Stripe webhook signatures, store processed event IDs, and make repeated delivery leave access and records unchanged.
Mixed modes can create records without granting the matching production access.
Fix prompt
Keep Stripe test and live keys in separate deployment environments. Confirm the production checkout, webhook, and price IDs all use live mode.
Whether payment events are verified, replay safe, and matched to the right customer record.
A URL cannot verify this. A Launch Review can.
Fix prompt
Replay a payment webhook twice and confirm the customer is only granted access once.
Client SDK checks do not replace deployed Firestore or Storage rules.
Fix prompt
Use the rules emulator or a test project to verify anonymous, owner, other-user, and administrator reads and writes for every collection and storage path.
Whether sign in, password or code reset, and session expiry behave under real use.
A URL cannot verify this. A Launch Review can.
Fix prompt
Sign in as two different accounts in two browsers and try to open the other account's pages by address.
Whether stored personal details are limited, deletable on request, and out of your logs.
A URL cannot verify this. A Launch Review can.
Fix prompt
Search your logs for an email address you know is in the database and see whether it appears.
Email addresses and other personal details can spread into long-lived logging systems.
Fix prompt
Trigger each customer-data flow, search the resulting logs for known personal values, then redact fields at the logging boundary and repeat the test.
Payment providers, app stores, and several privacy laws expect a reachable privacy page before you take anyone's details.
Fix prompt
Create a real privacy policy page at /privacy and link it from the footer on every page. It must cover what data the app collects, why, how long it is kept, who it is shared with, and how to request deletion, written for this specific app with no placeholder text and no lorem ipsum.
Without stated terms you have no written basis for suspending misuse or limiting your liability.
Fix prompt
Create a real terms of service page at /terms and link it from the footer on every page. It must cover what the service is, acceptable use, payment and cancellation terms, limitation of liability, and governing law, written for this specific app with no placeholder text and no lorem ipsum.
Explicit browser policies reduce avoidable exposure and make deployment behavior easier to inspect.
Fix prompt
This app sends no Content-Security-Policy header. Add one that starts from default-src 'self' and lists only the sources your app really loads. Roll it out in report-only mode first, watch the browser console on every page, then enforce it.
Anyone can rebuild your original files, including comments, file names, and any logic you assumed was hidden.
Fix prompt
Your production source map is public at {map_url}. Turn off source map output for production builds, or stop uploading the .map files, so readers only get the compiled bundle.Fallback routing can return app content where a clear missing or denied response belongs.
Fix prompt
Request a missing page and each common private path in production. Return the intended missing or denied response without internal details.
Production logs often outlive the request that created them and may be visible to more people.
Fix prompt
Review production logging. Remove tokens, authorization headers, full request bodies, personal details, and internal error stacks from user-facing responses.
Unused and outdated packages increase maintenance work and can change deployment behavior.
Fix prompt
List production dependencies, remove unused packages, review reported issues, and run the existing test and build commands after each change.
Expired sessions must stop protected work and return people to a recoverable sign-in state.
Fix prompt
Expire a session during a protected read and write. Confirm access stops, unsaved input is preserved where possible, and sign-in returns to the intended page.
Keeping personal data without a time limit increases operational and privacy obligations.
Fix prompt
List each personal field, why it is collected, its retention period, and the deletion job or manual process that enforces that period.
Private or personalized responses must not be reused for another visitor.
Fix prompt
Inspect caching for HTML, API responses, and service workers. Exclude authenticated, payment, and personal-data routes from shared caches.
Generated and agent-edited code still needs an explicit production review.
Fix prompt
Review the production build, server and browser boundary, environment values, and generated routes. Record every observed difference from preview.
A focused diff review catches unrelated generated changes before they reach production.
Fix prompt
Review the full release diff. Remove unrelated changes, confirm each changed file has an owner, and run the checks affected by that diff.
A dated record makes regressions and rollback decisions easier to explain.
Fix prompt
Record the release commit, production URL, test time, owner, observed result, and rollback reference for this launch.
Install this as a gate your agent has to pass
The launch checklist and repo guardrails you install yourself.
A URL cannot verify these
A written review of your production layer plus a recorded walkthrough.
Change all seven answers in the checklist generator.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026