The pre-launch checklist

Make two test accounts and spy on yourself

Create something as user A, log in as user B. B should not be able to see it in any list, search, or by changing a number in the address bar.

Every database table has access rules turned on

For Supabase that's row-level security (RLS) on every table. For Firebase, no rule that allows everyone to read or write.

No rule says "anyone can do anything" on private data

A policy of "true" lets any visitor read, change, or delete those rows.

Checks on money, permissions, and limits run on the server

Visitors can change anything in their own browser, so the server has to decide.

No secret keys in the page

Only public keys (like the Supabase anon or publishable key) belong in the browser. OpenAI, Stripe secret, and service_role keys stay on the server.

No secrets behind a public prefix

Anything named VITE_ or NEXT_PUBLIC_ is copied into the page visitors download.

Your .env file is not on GitHub

If it ever was, change (rotate) every key that was in it.

Public keys are restricted to your domain

Maps, captcha, and analytics keys can usually be locked to your site in the provider's dashboard.

Sign up as a stranger, on your phone, in a private window

Use an email address you've never used with the app.

The confirmation email arrives, and not in spam

Check the promotions and spam folders too.

Email links open your live site, not localhost or a preview

Check your auth settings' site URL and redirect URLs.

Password reset works end to end

Request a reset, click the link, set a new password, log in.

A declined card shows a clear message

Use your payment provider's test card for a decline.

A successful payment actually unlocks what they paid for

Even if they close the tab right after paying.

Live keys are in place and test mode is off

And your webhook points at your live domain.

The first screen shows up in a few seconds on a weak phone connection

A long white screen loses people before they see anything.

Every page works on a small phone screen

No sideways scrolling, buttons big enough to tap.

No broken images or error messages on the main pages

Click through every page once while logged out.

Your link shows a title, description, and image when shared

Text your link to yourself and look at the preview.

Every page has its own title

That's what shows in browser tabs and Google results.

robots.txt and sitemap.xml exist and don't block your site

Visit yoursite.com/robots.txt and yoursite.com/sitemap.xml.

HTTPS works and http:// redirects to it

Type your address with http:// and see where you land.

You'll hear about errors

Turn on your host's error emails or logs, and check them on launch day.

Re-check after every big change

A new feature or a new table can quietly undo an earlier fix.

People have a way to reach you

A contact email or form, so users report problems instead of leaving.