the boring pre-launch checklist

not the feature list. the ops stuff that bit me the first three times i shipped something to real users

error monitoring hooked up (sentry, or w/e)

shipped v1 with console.log as my error tracking. found a payment bug two weeks late, from a user email not from anything i built

automated db backups + a tested restore

having backups and having tested a restore are different claims, ymmv but i learned that one at 2am

health check endpoint

uptime monitoring on the actual prod url

first outage i heard about from twitter before my own monitor said a word. never again

custom 404 and 500 pages

rate limiting on signup + login

got hit with a bot signup wave on day 3. should've done this before launch, not after, tbh

secrets out of the repo, into env vars

staging env that mirrors prod

SPF/DKIM on the sending domain

half my welcome emails were landing in spam and nobody checks this until it's too late

unsubscribe link in every email

a terms of service + privacy page, even boilerplate

cookie banner if you're tracking eu visitors

idempotent webhook handling for payments

stripe retried a webhook and i double charged someone. the fix is one line: if already processed, return

account deletion that actually deletes data

load test the first endpoint people will actually hit

for me it was the signup form. hn traffic does not care about your free tier limits

a support inbox someone actually reads

Related lists