Application launch checklist

The night before a launch, the question is not does everything work, but what happens when something breaks. This checklist covers the points that separate a managed incident from a sleepless night.

Environments and configuration

• Production, staging and development are separated, with distinct secrets.
• No key or secret lives in the code or the git history.
• Production environment variables are documented and backed up.
• Domain, DNS and SSL certificate are verified and renewable.

Authentication and permissions

• Every role was tested with a real account of that role, not only as admin.
• Password recovery and invitation journeys work.
• Admin routes are unreachable without the right role.

Backups

• Database backups are automatic and dated.
• A full restore was tested at least once, not just configured.
• User files (uploads) are covered, not only the database.

Observability and error states

• Server errors are logged with enough context to diagnose.
• An alert reaches someone when the site or API goes down.
• User-facing error pages are clean: no stack trace, a way out.
• Empty states and payment failures show a useful message.

Analytics, consent and SEO

• Audience measurement respects consent and does not load before agreement.
• Public pages have correct titles, descriptions and social tags.
• Sitemap and robots.txt reflect the real public pages.

Rollback and ownership

• A deployment can be reverted quickly, and the procedure is written down.
• A specific person owns launch support, with a known channel.
• Critical access (hosting, DNS, database) is held by more than one person.