Guide
App launch checklist
Twelve steps, in the order they are worth doing, for a first launch of an app built with AI tools. Each one is something you can finish in a sitting.
The twelve steps
- 01
Pick the URL you will promote
One address, on https, serving the build you tested. Every other address should redirect to it.
- 02
Sign up as a stranger
Private window, fresh email. Create an account, sign out, sign back in, reset the password.
- 03
Buy something as a stranger
Use a real card on the live path. Confirm the access appears, then refund yourself.
- 04
Try to see someone else's data
Two accounts, side by side. If account A can load anything belonging to account B, stop and fix it.
- 05
Check what you shipped to the browser
Only publishable keys belong in client JavaScript. Service keys and source maps do not.
- 06
Turn on protective response headers
Content security policy, strict transport security, frame and sniffing controls, referrer policy.
- 07
Write the legal pages
Privacy, terms and refunds, reachable from every page, describing what your app actually does.
- 08
Make sure email arrives
Send a sign in link and a receipt to two different providers and check the spam folder.
- 09
Give people a way to reach you
One contact route that a human reads on launch day.
- 10
Prove you can restore the database
A backup you have never restored is not a backup. Restore one somewhere safe.
- 11
Know how to roll back
Write down the exact steps to serve the previous release, before you need them.
- 12
Run an outside check the morning of launch
The free check reads your live URL and tells you what it can see, what you declared, and what still needs a person.
Step twelve takes about twenty seconds and needs nothing but your URL.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.