Pre-Launch Flight Checklist for Founders

Ensure credentials have never been committed to Git history.

Confirm no secret tokens or private keys are exposed to client JavaScript.

Client components must only use the public anon key.

Replace test tokens with dedicated live production keys.

Using req.json() breaks Stripe HMAC cryptographic signature checks.

Revokes access when a customer cancels their subscription.

Never trust amounts or price IDs sent in client POST payloads.

Prevents Stripe from disabling your webhook endpoint due to retries.

Stops client anon keys from querying arbitrary customer rows.

Never trust req.json().userId for database updates or deletions.

Never dump raw exception objects or PostgreSQL schema to the browser.

Prevents 10-second table scans when RLS evaluates on queries.

Stops malicious sites from framing your login/checkout to steal clicks.

Prevents browsers from interpreting uploaded files as scripts.

Restricts script origins to approved providers like Stripe and Supabase.

Cuts off unauthenticated bot traffic from burning API credits.

Ensure dependency arrays contain primitive values only.

Confirm preview card looks crisp on Twitter/X and LinkedIn.

Remove default triangular Next.js or Vercel favicons.

Enables hosting platform uptime monitors to ping server health.