https://shipreadyai.dev/production-readiness-checklist

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Production readiness checklist for AI-built apps

A production readiness checklist is the set of things you confirm before real users and real money touch your app, covering transport, headers, exposed files, data access, payments and operations. ShipReady settles the parts an outside reader can observe in about twenty seconds, and this page covers the rest.

## Transport and certificate

- **http requests redirect to https** [Outside check]
  Done looks like: every plain http address returns a redirect to the https version of the same page.
- **The certificate is valid and not close to expiry** [Outside check]
  Done looks like: the certificate matches the hostname, chains correctly, and has weeks of life left.
- **Renewal is automatic** [Human review]
  Done looks like: you know which service renews the certificate and what happens if it fails.

## Response headers

- **A content security policy is present** [Outside check]
  Done looks like: the app sends a policy that names where scripts, styles and connections may come from.
- **Strict transport security is set** [Outside check]
  Done looks like: the header is sent on https responses with a sensible max age.
- **Framing and content type sniffing are controlled** [Outside check]
  Done looks like: frame ancestors are restricted and content type options are set to nosniff.
- **Referrer and permissions policies are deliberate** [Outside check]
  Done looks like: both headers are present and reflect a decision you made, not a default.

## Exposed files and paths

- **Source maps are not public** [Outside check]
  Done looks like: the map files referenced by your bundles are not reachable from the internet.
- **No server secrets in client bundles** [Outside check]
  Done looks like: only publishable keys appear in the JavaScript you ship. Service keys live server side.
- **Common sensitive paths return nothing useful** [Outside check]
  Done looks like: environment files, backups, admin panels and debug endpoints are absent or protected.

## Data and access

- **Every table has row level policies that match the intent** [Human review]
  Done looks like: each policy is written per operation and tested with a second account.
- **One account cannot read another account's rows** [Human review]
  Done looks like: you tried it with two real sessions and saw an empty result.
- **Roles are stored separately from profiles** [Human review]
  Done looks like: role changes require a privileged path, not an ordinary profile update.

## Payments

- **The webhook verifies its signature** [Human review]
  Done looks like: an unsigned or altered payload is rejected before anything is written.
- **Repeat events do not grant twice** [Human review]
  Done looks like: replaying the same event leaves the account in the same state.
- **Entitlement is written server side** [Human review]
  Done looks like: the client never decides what a customer has paid for.

## Operations

- **You can see errors from real users** [Human review]
  Done looks like: server and client errors reach somewhere a person looks at least daily.
- **You have a restore, not just a backup** [Human review]
  Done looks like: you have restored a copy of the database somewhere safe and it worked.
- **You can roll back a bad release** [Human review]
  Done looks like: the previous version can be served again without a rebuild scramble.
- **Someone owns the first hour after launch** [Human review]
  Done looks like: a named person is watching, with access to fix or revert.