Free checklist

Production SaaS Deployment Checklist

BuildSellSecure · Print this page or save it as PDF (Ctrl/Cmd + P)

Run this list before you call an app production ready. If a box is empty, the app is not done. Each item maps to the system taught in ShipStack (see the course).

Architecture and planning

• A written architecture diagram (client, API, database, proxy, CI).
• A pinned stack with a version manifest.
• Config comes from the environment, not code.

Application

• Front end is typed and structured by feature.
• Every API input is validated server-side.
• Errors are consistent and never leak stack traces.
• Structured logs use request IDs and contain no PII.

Data

• Schema has keys, constraints, and indexes.
• Migrations are versioned and reversible.
• Seeds use fictional data only.

Authentication and authorization

• Passwords are hashed with a modern algorithm.
• Sessions use HttpOnly, Secure, and SameSite cookies.
• Object-level authorization is enforced on every resource.
• Auth endpoints are rate-limited.

Billing

• Subscriptions work in the provider's test mode.
• Webhook signatures are verified.
• Webhooks are idempotent (processed once).
• Trials, failures, upgrades, and cancellations are handled.

Delivery

• Dockerfiles build small, non-root images.
• Compose runs the full stack locally and in production.
• Nginx reverse proxy is configured with security headers.
• TLS works and renews automatically.
• GitHub Actions runs lint, typecheck, test, and build.
• Deploys health-check and can roll back.

Observability and recovery

• A /health endpoint reports app and database status.
• One meaningful alert is configured.
• Database backups are scheduled and offsite.
• A restore has been tested.
• A rollback runbook exists and has been rehearsed.