The pre-launch checklist for web apps: 20 things to verify

Launching is exciting — and it’s exactly when hidden problems surface. Use this checklist before you invite real users.

Security

1. Every route checks permissions. Logged-in is not the same as allowed. Test that user A cannot see user B’s data by changing an ID in the URL.
2. No secrets in the frontend. API keys for payments, email or databases must live on the server.
3. Secrets rotated if they were ever committed to the repository.
4. Database access rules are enabled and tested, not just “on”.
5. Dependencies scanned for known vulnerabilities.

Payments

6. Webhooks are verified with the provider’s signature.
7. Cancellations and refunds actually change the user’s access.
8. Test and live keys are separated.

Reliability

9. Errors are handled — users see a helpful message, not a blank screen.
10. Error tracking is in place so you hear about problems before customers tell you.
11. Backups are on, and you’ve tested a restore.
12. Automated tests cover sign-up, login, payment and your core action.
13. A staging environment exists, separate from production.

Performance & SEO

14. Pages load quickly on a mid-range phone.
15. Images are compressed and sized correctly.
16. Every page has a title and description.
17. A sitemap and robots.txt are published.

Handoff & ownership

18. The code is in your repository.
19. Hosting, domain and payment accounts are in your name.
20. There’s a README explaining how to run and deploy the project.

If more than a few of these are unchecked, an App Audit will tell you exactly what to fix and what it will cost.