Skip to content
Throttle Bird

Pre-launch checklist

Throttle Bird · throttlebird.com/checklist · updated 2026-10-17

App: ______________________________ Date: ____________

Your data

  • Make two test accounts and spy on yourselfCreate something as user A, log in as user B. B should not be able to see it in any list, search, or by changing a number in the address bar.
  • Every database table has access rules turned onFor Supabase that's row-level security (RLS) on every table. For Firebase, no rule that allows everyone to read or write.
  • No rule says "anyone can do anything" on private dataA policy of "true" lets any visitor read, change, or delete those rows.
  • Checks on money, permissions, and limits run on the serverVisitors can change anything in their own browser, so the server has to decide.

Keys and secrets

  • No secret keys in the pageOnly public keys (like the Supabase anon or publishable key) belong in the browser. OpenAI, Stripe secret, and service_role keys stay on the server.
  • No secrets behind a public prefixAnything named VITE_ or NEXT_PUBLIC_ is copied into the page visitors download.
  • Your .env file is not on GitHubIf it ever was, change (rotate) every key that was in it.
  • Public keys are restricted to your domainMaps, captcha, and analytics keys can usually be locked to your site in the provider's dashboard.

Sign-up and email

  • Sign up as a stranger, on your phone, in a private windowUse an email address you've never used with the app.
  • The confirmation email arrives, and not in spamCheck the promotions and spam folders too.
  • Email links open your live site, not localhost or a previewCheck your auth settings' site URL and redirect URLs.
  • Password reset works end to endRequest a reset, click the link, set a new password, log in.

Payments (if you charge)

  • A declined card shows a clear messageUse your payment provider's test card for a decline.
  • A successful payment actually unlocks what they paid forEven if they close the tab right after paying.
  • Live keys are in place and test mode is offAnd your webhook points at your live domain.

Speed and mobile

  • The first screen shows up in a few seconds on a weak phone connectionA long white screen loses people before they see anything.
  • Every page works on a small phone screenNo sideways scrolling, buttons big enough to tap.
  • No broken images or error messages on the main pagesClick through every page once while logged out.

Sharing and search

  • Your link shows a title, description, and image when sharedText your link to yourself and look at the preview.
  • Every page has its own titleThat's what shows in browser tabs and Google results.
  • robots.txt and sitemap.xml exist and don't block your siteVisit yoursite.com/robots.txt and yoursite.com/sitemap.xml.
  • HTTPS works and http:// redirects to itType your address with http:// and see where you land.

After launch

  • You'll hear about errorsTurn on your host's error emails or logs, and check them on launch day.
  • Re-check after every big changeA new feature or a new table can quietly undo an earlier fix.
  • People have a way to reach youA contact email or form, so users report problems instead of leaving.

Check keys, database access, headers, HTTPS, and link previews automatically with a free scan at throttlebird.com.