This checklist covers the launch work that changes for Cursor or Claude Code, Supabase, and None. It uses fixed rules and gives you direct prompts before you publish.
Defaults for the remaining questions
Auth: Email code. AI features: No. Customer data: Personal data. Hosting: Other.
Preview and production can return different routes, headers, and environment values.
Fix prompt
Plain http requests do not redirect to https. Find the hosting or server layer that owns redirects, add a permanent http to https redirect for all paths, and show me the diff plus a curl -I of the http address.
A working first screen does not prove the main task completes.
Fix prompt
Cursor prompt: Run the main user journey from a clean browser. Record each request, state change, failure path, and final result. Apply it across the project, run the relevant checks, and show the diff.
Hidden buttons do not stop a direct request to a protected action.
Fix prompt
Cursor prompt: List every protected read and write. Enforce identity and ownership on the server for each one, then test a second account against them. Apply it across the project, run the relevant checks, and show the diff.
Browser validation can be skipped by direct requests.
Fix prompt
Cursor prompt: Add strict server-side validation and length limits to every public or authenticated mutation. Return clear errors without internal details. Apply it across the project, run the relevant checks, and show the diff.
Anyone who opens the page can read this key and use it directly against the service it belongs to, with your account paying for it.
Fix prompt
A {pattern} is bundled into {bundle}. Rotate it, move its use to a server function with server-only env, remove it from client env, rebuild, and verify the prefix is gone from dist. Do not print the value.Timeouts and rejected requests need a truthful, recoverable interface.
Fix prompt
Cursor prompt: Force the main external request to time out and fail. Show a truthful error, preserve user input, and provide a retry that cannot duplicate work. Apply it across the project, run the relevant checks, and show the diff.
Whether you can put the previous version back, and how long that takes.
A URL cannot verify this. A Launch Review can.
Fix prompt
Deploy a trivial change, then roll it back, and time how long the app is wrong for.
Whether a failure in production reaches a human rather than sitting in a log nobody opens.
A URL cannot verify this. A Launch Review can.
Fix prompt
Trigger a deliberate error in production and see whether anything alerts you within five minutes.
Whether a script can hammer your forms, sign up loop, or paid endpoints without being slowed down.
A URL cannot verify this. A Launch Review can.
Fix prompt
Send the same form fifty times in a minute from one address and see whether anything stops you.
Whether the layout actually works at phone width. A viewport tag allows the page to adapt; it does not prove anything fits.
A URL cannot verify this. A Launch Review can.
Fix prompt
Open every important page at 375, 390, 768, 1024 and 1440 pixels wide and look for sideways scrolling, cut text and buttons under forty four pixels.
Whether the row rules behind the app actually stop one signed in account reading another's rows.
A URL cannot verify this. A Launch Review can.
Fix prompt
Sign in as one account and request another account's record by id through the API.
A service role bypasses row-level access checks and must never reach browser code.
Fix prompt
Cursor prompt: Search browser imports, environment variables, logs, and built files for the service role. Move every privileged operation behind an authenticated server function. Apply it across the project, run the relevant checks, and show the diff.
Whether sign in, password or code reset, and session expiry behave under real use.
A URL cannot verify this. A Launch Review can.
Fix prompt
Sign in as two different accounts in two browsers and try to open the other account's pages by address.
Whether stored personal details are limited, deletable on request, and out of your logs.
A URL cannot verify this. A Launch Review can.
Fix prompt
Search your logs for an email address you know is in the database and see whether it appears.
Email addresses and other personal details can spread into long-lived logging systems.
Fix prompt
Cursor prompt: Trigger each customer-data flow, search the resulting logs for known personal values, then redact fields at the logging boundary and repeat the test. Apply it across the project, run the relevant checks, and show the diff.
Payment providers, app stores, and several privacy laws expect a reachable privacy page before you take anyone's details.
Fix prompt
Create a real privacy policy page at /privacy and link it from the footer on every page. It must cover what data the app collects, why, how long it is kept, who it is shared with, and how to request deletion, written for this specific app with no placeholder text and no lorem ipsum. Match the existing page components and add the footer link. Show me the diff and the rendered route.
Without stated terms you have no written basis for suspending misuse or limiting your liability.
Fix prompt
Create a real terms of service page at /terms and link it from the footer on every page. It must cover what the service is, acceptable use, payment and cancellation terms, limitation of liability, and governing law, written for this specific app with no placeholder text and no lorem ipsum. Match the existing page components and add the footer link. Show me the diff and the rendered route.
Explicit browser policies reduce avoidable exposure and make deployment behavior easier to inspect.
Fix prompt
This app sends no Content-Security-Policy header. Add one at the response layer with default-src 'self', object-src 'none', base-uri 'self', frame-ancestors 'none', plus the exact origins the app loads, using a nonce for inline scripts. Start report-only, clear the console on every route, then enforce. Show me the policy.
Anyone can rebuild your original files, including comments, file names, and any logic you assumed was hidden.
Fix prompt
A production source map is public at {map_url} for {bundle}. Disable production source maps in the build config or stop deploying .map files, then confirm the URL 404s. Show me the config change.Fallback routing can return app content where a clear missing or denied response belongs.
Fix prompt
Cursor prompt: Request a missing page and each common private path in production. Return the intended missing or denied response without internal details. Apply it across the project, run the relevant checks, and show the diff.
Production logs often outlive the request that created them and may be visible to more people.
Fix prompt
Cursor prompt: Review production logging. Remove tokens, authorization headers, full request bodies, personal details, and internal error stacks from user-facing responses. Apply it across the project, run the relevant checks, and show the diff.
Unused and outdated packages increase maintenance work and can change deployment behavior.
Fix prompt
Cursor prompt: List production dependencies, remove unused packages, review reported issues, and run the existing test and build commands after each change. Apply it across the project, run the relevant checks, and show the diff.
A fallback that answers 200 for an address that never existed gets indexed and hides broken links.
Fix prompt
Cursor prompt: Request a made up address in production. Return a 404 status and render your own missing page on it, with a way back to the main task. Apply it across the project, run the relevant checks, and show the diff.
A dead link on a launch page reads as an abandoned product.
Fix prompt
Cursor prompt: Crawl every public page, follow every internal link and every outbound citation, record the status of each, and fix or remove the ones that error. Apply it across the project, run the relevant checks, and show the diff.
Duplicated or missing titles leave search results and shared links showing the address instead of the product.
Fix prompt
Cursor prompt: Generate a unique title under sixty characters and a description under a hundred and sixty for every public page, from that page's own constants. Fix duplicates at the source, not page by page. Apply it across the project, run the relevant checks, and show the diff.
A link with no card looks unfinished next to every other link in the same thread.
Fix prompt
Cursor prompt: Add og:image and twitter:image with a full https address, sized twelve hundred by six hundred and thirty and under two hundred kilobytes. Paste the link into a preview debugger and confirm the card renders. Apply it across the project, run the relevant checks, and show the diff.
A screen reader announces the file name, or nothing at all, where alt text is missing.
Fix prompt
Cursor prompt: Crawl the public pages and list every image with no alt attribute. Describe what each one shows, or mark it decorative with an empty alt attribute. Apply it across the project, run the relevant checks, and show the diff.
On a phone connection the first screen waits for the heaviest image on it.
Fix prompt
Cursor prompt: Export every image at the size it is displayed, serve a modern format with a fallback, keep the largest under a few hundred kilobytes, and record the size of each one. Apply it across the project, run the relevant checks, and show the diff.
Whether the first screen arrives quickly on a phone connection. This check reads the page once from a server, which says nothing about what a visitor on a train sees.
A URL cannot verify this. A Launch Review can.
Fix prompt
Run Lighthouse on the published address with the mobile profile and a slow connection, and read the largest contentful paint.
Whether text and controls stay readable against their background, including muted text, placeholders, disabled buttons and focus outlines.
A URL cannot verify this. A Launch Review can.
Fix prompt
Run an accessibility audit on the published pages and check every pairing reaches four and a half to one for body text and three to one for large text and controls.
Whether a script can post your public forms repeatedly. Sending test traffic at your forms is not something an outside check should do uninvited.
A URL cannot verify this. A Launch Review can.
Fix prompt
Post your own form fifty times in a minute with a script and see whether anything slows it down or refuses it.
Whether a banner appears where it is required, and whether declining actually stops anything being stored.
A URL cannot verify this. A Launch Review can.
Fix prompt
Open the site in a clean browser, decline, then read the cookies and local storage and confirm nothing beyond the choice itself was written.
Whether a visitor arriving cold knows the single next step. That is a judgement about your product, not something a request can read.
A URL cannot verify this. A Launch Review can.
Fix prompt
Show the first screen to someone who has never seen it and ask what they are meant to do next.
Privileged reads and writes need an authenticated server boundary.
Fix prompt
Cursor prompt: Review every privileged Supabase read and write. Keep it inside an authenticated server function and test the function with two accounts. Apply it across the project, run the relevant checks, and show the diff.
A row policy cannot help when the intended role lacks table access, and broad grants expand exposure.
Fix prompt
Cursor prompt: Review table grants and row policies together. Grant only the operations each role needs, then test allowed and denied requests through the app. Apply it across the project, run the relevant checks, and show the diff.
Expired sessions must stop protected work and return people to a recoverable sign-in state.
Fix prompt
Cursor prompt: Expire a session during a protected read and write. Confirm access stops, unsaved input is preserved where possible, and sign-in returns to the intended page. Apply it across the project, run the relevant checks, and show the diff.
Keeping personal data without a time limit increases operational and privacy obligations.
Fix prompt
Cursor prompt: List each personal field, why it is collected, its retention period, and the deletion job or manual process that enforces that period. Apply it across the project, run the relevant checks, and show the diff.
Private or personalized responses must not be reused for another visitor.
Fix prompt
Cursor prompt: Inspect caching for HTML, API responses, and service workers. Exclude authenticated, payment, and personal-data routes from shared caches. Apply it across the project, run the relevant checks, and show the diff.
A blank tab is one of the first things a visitor reads as unfinished.
Fix prompt
Cursor prompt: Build the icon set from the logo, including a favicon.ico, an SVG, an Apple touch icon and a maskable icon in the manifest. Request each file and confirm it answers with the right content type. Apply it across the project, run the relevant checks, and show the diff.
Without them, search engines guess which pages exist and private or draft addresses can be found by accident.
Fix prompt
Cursor prompt: Publish a robots.txt that allows the public pages and a sitemap listing every public page once, with no private or draft addresses. Name the sitemap in robots.txt and confirm both answer with 200. Apply it across the project, run the relevant checks, and show the diff.
The first week of traffic cannot be recovered later if nothing was counting.
Fix prompt
Cursor prompt: Add a tool that records visits without storing cookies, confirm each event fires once, and confirm no page address and no email address reaches it. Apply it across the project, run the relevant checks, and show the diff.
Generated and agent-edited code still needs an explicit production review.
Fix prompt
Cursor prompt: Review the production build, server and browser boundary, environment values, and generated routes. Record every observed difference from preview. Apply it across the project, run the relevant checks, and show the diff.
A focused diff review catches unrelated generated changes before they reach production.
Fix prompt
Cursor prompt: Review the full release diff. Remove unrelated changes, confirm each changed file has an owner, and run the checks affected by that diff. Apply it across the project, run the relevant checks, and show the diff.
A dated record makes regressions and rollback decisions easier to explain.
Fix prompt
Cursor prompt: Record the release commit, production URL, test time, owner, observed result, and rollback reference for this launch. Apply it across the project, run the relevant checks, and show the diff.
Install this as a gate your agent has to pass
The launch checklist and repo guardrails you install yourself.
A URL cannot verify these
A written review of your production layer plus a recorded walkthrough.
Change all seven answers in the checklist generator.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated October 29, 2026