Guide

Launch readiness checklist

Going public is a schedule problem as much as a technical one. This is what to confirm in the week before, what to have ready on the day, and what to deliberately not touch until the launch is behind you.

Run the free check What we check

The week before

The public URL is the one you will actually promote
Outside check
Done looks like: the domain resolves, redirects to https, and serves the same build you tested.
Sign up, sign in and password reset all work from a clean browser
Human review
Done looks like: you completed each flow in a private window with a fresh address.
The paid path works end to end with a real card
Human review
Done looks like: a live charge produced the access it promised, and a refund reversed it.
Nothing in the shipped JavaScript should be private
Outside check
Done looks like: no service keys, no internal endpoints, no source maps.

The day before

Legal pages exist and say what you actually do
Outside check
Done looks like: privacy, terms and refunds are reachable from every page.
Email reaches the inbox, not the spam folder
Human review
Done looks like: sign in and receipt emails arrived at two different providers.
You can reach support
Human review
Done looks like: the contact route on the site lands somewhere a person reads.
A recent database copy is restorable
Human review
Done looks like: you restored it once and the app ran against the copy.

Launch day

Errors are visible in real time
Human review
Done looks like: a dashboard or alert channel shows server and client failures as they happen.
You can revert within minutes
Human review
Done looks like: the previous release is one action away.
One person is on watch
Human review
Done looks like: a named owner with access is free of other work for the first hours.

Leave it until after launch

Rewrites and refactors
Human review
Done looks like: the code you tested is the code you ship. Improvements wait for the next release.
New features requested in the first hour
Human review
Done looks like: they are written down, not merged.
Infrastructure moves
Human review
Done looks like: hosting, region and database plan stay as they were during testing.

What an outside check can see

Item	Visible from outside?
Redirect and certificate	Yes, directly against your live URL.
Protective response headers	Yes, present or missing, header by header.
Public source maps	Yes, by following the references in your bundles.
Secrets in client JavaScript	Yes, and publishable keys are never counted as leaks.
Common sensitive paths	Yes, a short list of well known addresses.
Row level policy correctness	No. This needs authenticated access and a person.
Payment webhook behaviour	No. This needs code or a test event.
Backups and rollback	No. Nothing external can see these.

Settle the outside column first, then spend your remaining time on the rest.

Run the free check See pricing

ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.