Pre-Deployment Security Checklist: 26-Item Guide Before Going Live

TL;DR

Before you deploy, check for hardcoded secrets, unset environment variables, missing HTTPS, unprotected routes, open database access, unvalidated input, missing security headers and error pages that leak details. Fix the 8 critical items before launch. The 12 important ones can wait a week, and the 6 recommended ones can wait until you have time.

Think of this as your preflight checklist. Pilots don't skip theirs after a hundred flights, and you shouldn't skip this because you've deployed before.

Twenty-six items sounds like a lot. Most take under a minute to verify, though, and anything you catch here is far cheaper to fix than something a user finds in production.

Quick Checklist (5 Critical Items)

No hardcoded API keys or secretsSearch for sk_, pk_, api_key, secret, password in your code

.env files in .gitignoreVerify .env, .env.local, .env.production are not committed

HTTPS enabledSSL/TLS certificate installed and HTTP redirects to HTTPS

All protected routes require authenticationTest each route without a session - should redirect to login

Row Level Security enabled (if using Supabase)RLS policies on all tables that need access control

Secrets & Configuration 5

No hardcoded API keys or secretsSearch for sk_, pk_, api_key, apiKey, secret, password, token in your codebase. How to secure API keys

All secrets in environment variablesDatabase URLs, API keys, and tokens should come from process.env. How to configure env variables

.env files in .gitignoreVerify .env, .env.local, .env.production are not committed. How to secure .env files

Production environment variables configuredSet all required variables in your hosting platform (Vercel, Railway, etc.). How to deploy env variables

No development/test credentials in productionRemove Stripe test keys, sandbox API keys, and mock credentials. How to manage API keys

HTTPS & Transport 3

HTTPS enabledSSL/TLS certificate installed and working. How to set up HTTPS

HTTP redirects to HTTPSAll HTTP requests should 301 redirect to HTTPS. How to configure HTTPS redirect

HSTS header configuredStrict-Transport-Security header with appropriate max-age. How to configure HSTS

Authentication & Authorization 5

All protected routes require authenticationTest each route with no session - should redirect to login. How to test protected routes

API routes verify authenticationEvery API endpoint that needs auth should check session/token. How to implement auth checks

Authorization checks in placeUsers can only access their own data, not other users' data. How to test data isolation

Session cookies are secureHttpOnly, Secure, SameSite flags set appropriately. How to secure session cookies

Password reset flow secureTokens are single-use, time-limited, and cryptographically random. How to secure password reset

Database Security 4

Row Level Security enabled (if using Supabase)RLS policies on all tables that need access control. How to set up Supabase RLS

Parameterized queries onlyNo string concatenation in SQL queries. How to prevent SQL injection

Database user has minimal permissionsApp database user should not have admin/superuser privileges. How to set database permissions

Backups configuredAutomated database backups with tested restore process. How to set up database backups

Input Validation 3

All user input validated server-sideNever trust client-side validation alone. How to validate on server

File uploads restrictedCheck file types, sizes, and scan for malicious content. How to secure file uploads

Rate limiting on sensitive endpointsLogin, signup, password reset, and API endpoints rate limited. How to implement rate limiting

Security Headers 3

Content-Security-Policy configuredRestrict script sources and prevent XSS. How to configure CSP

X-Frame-Options setPrevent clickjacking with DENY or SAMEORIGIN. How to prevent clickjacking

X-Content-Type-Options setSet to nosniff to prevent MIME type sniffing. How to set security headers

Error Handling & Logging 3

Production errors don't leak stack tracesUsers see friendly errors, not technical details. How to handle errors securely

Security events loggedFailed logins, permission denials, and suspicious activity. How to log security events

No sensitive data in logsPasswords, tokens, and PII should not appear in logs. How to secure logging

How to Use This Checklist

Work through every item before you push to production. Found a problem? Fix it before moving on. The list covers the issues that turn up most often in vibe-coded apps, and the secrets section is where we'd start. A leaked key is the one mistake a redeploy can't undo: once it's public, you have to rotate it.

How long should this checklist take?

Expect 30-60 minutes for a simple app and 2-3 hours for a bigger one. The first pass is the slow one, since you'll probably be fixing things as you go. After that it's quick.

What if I can't complete all items?

Secrets & Configuration and HTTPS & Transport are non-negotiable. The rest depends on your app: no user accounts means you can skip the auth items. Handle any user data at all, though, and every item applies.

Should I automate these checks?

Yes. CI/CD pipelines, security scanners and monitoring can handle a lot of these. Let the tools catch problems early, and use this checklist as the final pass before you deploy.