Production Readiness Audit

Production Readiness Checklist

A practical pass over the things that quietly break AI-built and early SaaS apps in production. Tick what's true today. Anything you can't tick with confidence is a launch risk.

By Aleksandar Grbic · aleksandar.xyz/production-audit

Auth & authorization

• Sessions/tokens expire, rotate, and can be revoked.
• Every endpoint checks authorization, not just authentication.
• No object can be accessed by changing an ID in the URL (IDOR).
• Password reset and email-change flows are abuse-resistant.

Multi-tenancy & data isolation

• Every query is scoped to the current tenant/org.
• One customer can never read or write another's data.
• Tenant isolation is enforced server-side, not in the UI.

Database, migrations & backups

• Schema changes run as versioned, reversible migrations.
• Automated backups run on a schedule.
• You have actually restored from a backup and it worked.
• Critical columns have indexes and constraints.

Secrets & environment handling

• No secrets in the repo, client bundle, or logs.
• Secrets live in one managed place, not scattered files/dashboards.
• Production and staging use separate credentials.
• Secrets can be rotated without a redeploy scramble.

Stripe, billing & webhooks

• Webhook signatures are verified.
• Webhook handlers are idempotent and survive retries.
• Failed/declined payments and dunning are handled.
• Subscription state in your DB matches Stripe.

Email & transactional flows

• SPF, DKIM, and DMARC are configured.
• Transactional email (verify, reset, receipts) is reliable.
• Bounces and complaints are monitored.

Background jobs & queues

• Long work runs in jobs, not inside web requests.
• Jobs retry with backoff and have a dead-letter path.
• Jobs are idempotent and safe to run twice.

Observability: logs, metrics & alerts

• Errors are captured in a tracker (e.g. Sentry).
• Logs are structured, searchable, and retained.
• You get alerted before customers tell you it's down.
• Key metrics (latency, error rate, queue depth) are visible.

Deployment, staging, rollback, DNS, TLS & CDN

• Deploys are repeatable and don't depend on one laptop.
• A staging environment mirrors production.
• You can roll back a bad deploy quickly.
• TLS, DNS, and CDN/caching are correctly configured.

Infrastructure costs & failure points

• You know your monthly infra cost and what drives it.
• No single point of failure takes the whole app down.
• Rate limits and resource limits are in place.

Security footguns & launch blockers

• Input is validated server-side; output is escaped.
• Dependencies are reasonably current and scanned.
• Admin/debug endpoints aren't exposed in production.
• PII handling and data retention are intentional.

Operational runbooks

• There's a written "it's down, what do I do" runbook.
• Restore, rollback, and key rotation steps are documented.
• Someone other than the original author could operate it.