Guide

Production readiness checklist for AI-built apps

AI tools produce working apps quickly, and the gaps they leave are consistent. This checklist covers what to confirm before real users arrive, and marks which items an outside check can settle for you and which need a person with access.

Run the free check What we check

Transport and certificate

http requests redirect to https
Outside check
Done looks like: every plain http address returns a redirect to the https version of the same page.
The certificate is valid and not close to expiry
Outside check
Done looks like: the certificate matches the hostname, chains correctly, and has weeks of life left.
Renewal is automatic
Human review
Done looks like: you know which service renews the certificate and what happens if it fails.

Response headers

A content security policy is present
Outside check
Done looks like: the app sends a policy that names where scripts, styles and connections may come from.
Strict transport security is set
Outside check
Done looks like: the header is sent on https responses with a sensible max age.
Framing and content type sniffing are controlled
Outside check
Done looks like: frame ancestors are restricted and content type options are set to nosniff.
Referrer and permissions policies are deliberate
Outside check
Done looks like: both headers are present and reflect a decision you made, not a default.

Exposed files and paths

Source maps are not public
Outside check
Done looks like: the map files referenced by your bundles are not reachable from the internet.
No server secrets in client bundles
Outside check
Done looks like: only publishable keys appear in the JavaScript you ship. Service keys live server side.
Common sensitive paths return nothing useful
Outside check
Done looks like: environment files, backups, admin panels and debug endpoints are absent or protected.

Data and access

Every table has row level policies that match the intent
Human review
Done looks like: each policy is written per operation and tested with a second account.
One account cannot read another account's rows
Human review
Done looks like: you tried it with two real sessions and saw an empty result.
Roles are stored separately from profiles
Human review
Done looks like: role changes require a privileged path, not an ordinary profile update.

Payments

The webhook verifies its signature
Human review
Done looks like: an unsigned or altered payload is rejected before anything is written.
Repeat events do not grant twice
Human review
Done looks like: replaying the same event leaves the account in the same state.
Entitlement is written server side
Human review
Done looks like: the client never decides what a customer has paid for.

Operations

You can see errors from real users
Human review
Done looks like: server and client errors reach somewhere a person looks at least daily.
You have a restore, not just a backup
Human review
Done looks like: you have restored a copy of the database somewhere safe and it worked.
You can roll back a bad release
Human review
Done looks like: the previous version can be served again without a rebuild scramble.
Someone owns the first hour after launch
Human review
Done looks like: a named person is watching, with access to fix or revert.

Start with the items an outside check can settle in about twenty seconds.

Run the free check See pricing

ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.