The Only Pre-Deployment Checklist You Need

Introduction

Shipping to production for the first time is exhilarating. You've built something, tested it locally, and now you're ready to let real users interact with it.

But shipping without proper preparation is how weekend incidents happen. It's how security breaches start.

This guide walks you through a 10-point pre-deployment checklist that will bulletproof your application.

Why a Pre-Deployment Checklist Matters

A solid pre-deployment checklist catches 90% of common failure modes before they affect users. It takes about 2-4 hours per project to set up properly, and it saves you from weeks of firefighting.

The 10-Point Pre-Deployment Checklist

1. Hardened Authorization

Every resource access must verify ownership on the backend. Never rely on the frontend to enforce permissions.

// GOOD: Backend enforces authorization
app.get("/api/resources/:id", async (req, res) => {
  const resource = await db.resources.findById(req.params.id);

  // Check ownership on the backend
  if (resource.ownerId !== req.user.id) {
    return res.status(403).json({ error: "Unauthorized" });
  }

  res.json(resource);
});

Checklist item: Before deploying, verify that at least 3 critical resources enforce authorization on the backend.

---

2. Validation & Sanitization

Never trust user input. Validate against strict schemas and sanitize HTML.

import { z } from "zod";

const createUserSchema = z.object({
  email: z.string().email(),
  name: z.string().min(1).max(100)
});

app.post("/api/users", async (req, res) => {
  const result = createUserSchema.safeParse(req.body);

  if (!result.success) {
    return res.status(400).json({ error: result.error });
  }
});

---

3. Tighten CORS Policies

Lock down your CORS configuration to specific domains.

app.use(cors({
  origin: ["https://yourapp.com", "https://www.yourapp.com"],
  credentials: true,
}));

---

4. Rate Limiting

Set up rate limiting on all public API endpoints to prevent abuse.

---

5. Expiring Security Links

Force password reset tokens to expire within 15-30 minutes max.

---

6. Graceful Frontend Error Handling

Use error boundaries and fallback screens. Never expose stack traces.

---

7. Strategic Database Indexing

Build indexes on frequently queried fields (foreign keys, filters).

---

8. Cost-Effective Logging

Use structured logging for critical paths with tight retention windows.

---

9. Actionable Proactive Alerts

Set up alerts for error rates, latency, and uptime spikes.

---

10. Fail-Safe Rollback Strategy

Adopt blue-green deployments for instant rollback capability.

---

Complete Pre-Deployment Checklist

[ ] Authorization enforced on backend [ ] Input validation and sanitization [ ] CORS locked to specific domains [ ] Rate limits on public endpoints [ ] Security links expire in 15-30 min [ ] Error boundaries in place [ ] Database indexes on frequent queries [ ] Structured logging configured [ ] Alerts set up for critical metrics [ ] Rollback procedure tested

Related Guides

Before deploying, understand your architectural decisions. Check out Microservices vs. Monoliths to ensure your architecture is appropriate for your current scale, and System Evolution to understand when to scale infrastructure.

Also review our guide on 3 Fatal Mistakes "Vibe Coders" Make to ensure you're not missing critical security measures.

Key Takeaways

1. Security first - Authorization, validation, CORS are non-negotiable
2. Monitoring always - You can't fix what you can't see
3. Plan for failure - Rollback procedures save you from disasters
4. Incremental, not perfect - You don't need everything on day one
5. Test in production carefully - Use feature flags and blue-green deployments

For more on production reliability, see our guide on Platform Stability: Is Software Less Reliable Now?.

For comprehensive security guidance, refer to the OWASP Top 10 and OWASP API Security.

---

Ready to deploy? Run through the 10-point checklist above. Your future self will thank you when the 2 AM incident doesn't happen.