# Production-Readiness Checklist for Modern Applications
*By Adam Blansett — Senior Full-Stack & AI Engineer (adamblansett.com)*

This actionable 25-point checklist is designed for engineering leaders, CTOs, and developers preparing to deploy web applications, distributed APIs, mobile apps, or AI-integrated systems to production.

---

## 1. Architecture & Code Quality
- [ ] **Decoupled Business Logic:** Domain logic is decoupled from HTTP handlers, framework controllers, and database models to allow testability in isolation.
- [ ] **Consistent Environment Configuration:** Zero hardcoded hosts, credentials, or URLs. All environment variables are validated at build/boot time using a schema library (e.g., Zod, Envalid, or strict TypeScript types).
- [ ] **Dead Code & Dependency Pruning:** Unused dependencies, obsolete scaffolding packages, and abandoned experimental routes are purged before deployment.
- [ ] **Type Safety & Strict Boundaries:** API request payloads, query params, and database records use strict compile-time or runtime type schemas.

## 2. Observability, Logging & Error Telemetry
- [ ] **Centralized Error Tracking:** Sentry (or equivalent) is initialized across both client and server with release version tagging, environment isolation (`production` vs `staging`), and source maps.
- [ ] **Structured JSON Logging:** Server logs emit structured JSON (level, timestamp, message, correlation ID, user context where compliant) rather than unparsed `console.log` strings.
- [ ] **Distributed Correlation IDs:** Incoming HTTP requests generate or propagate an `X-Request-ID` across downstream services and background queues.
- [ ] **Actionable Health Check Endpoints:** Dedicated `/healthz` or `/api/health` endpoints verify database connectivity, cache availability, and queue status without heavy payload execution.

## 3. Security, Authentication & Secret Governance
- [ ] **Zero Hardcoded Secrets:** Secret scanning (e.g., GitGuardian, gitleaks, or GitHub secret scanning) passes cleanly with no API keys, tokens, or private keys committed to Git history.
- [ ] **Secrets Manager Integration:** Production credentials reside in AWS Secrets Manager, Google Secret Manager, HashiCorp Vault, or encrypted platform vaults—never in unencrypted repository files.
- [ ] **Strict Session Management & Expiry:** Auth tokens use `HttpOnly`, `Secure`, `SameSite=Strict/Lax` cookies with bounded lifetimes and explicit server-side revocation on logout.
- [ ] **Role-Based Access Control (RBAC):** Every endpoint enforces server-side permission checks independently of client-side UI visibility.
- [ ] **Rate Limiting & Abuse Prevention:** Public endpoints (auth, password reset, payment, LLM inference) enforce IP- or user-scoped rate limiting (e.g., Redis leaky bucket or Cloudflare WAF).

## 4. Data Persistence & Migration Reliability
- [ ] **Idempotent Database Migrations:** Schema migrations run deterministically, handle restarts gracefully, and are tested against realistic staging datasets before running on production.
- [ ] **Non-Destructive Schema Evolution:** New columns are nullable or have defaults; renames follow a expand-and-contract phase to prevent downtime during rolling deployments.
- [ ] **Connection Pooling Configured:** Database connection pools (PgBouncer, Prisma Accelerate, AWS RDS Proxy) are sized to prevent thread exhaustion during traffic spikes.
- [ ] **Automated Backups & Point-in-Time Recovery (PITR):** Production databases have automated daily snapshots, point-in-time recovery enabled, and a documented restore drill.

## 5. Resilience, Failure Modes & Background Queuing
- [ ] **Bounded HTTP Timeouts:** All external HTTP and RPC calls specify explicit connection and read timeouts (never infinite hangs).
- [ ] **Exponential Backoff & Retries:** Transmit retries for network-flaky external APIs employ exponential backoff with jitter and max attempt limits.
- [ ] **Idempotent Webhook Processing:** Incoming webhooks verify cryptographic signatures (e.g., Stripe, GitHub) and record processed event IDs to prevent duplicate transaction execution.
- [ ] **Dead-Letter Queues (DLQ):** Background job workers (RabbitMQ, BullMQ, SQS) route repeatedly failing payloads to an inspection queue rather than blocking or dropping messages.

## 6. Deployment Safety & Automated CI/CD
- [ ] **Automated Test Gate in CI:** Automated tests (unit, integration, contract) execute and must pass before pull requests can merge to main/production branches.
- [ ] **Deterministic Static / Container Builds:** Production builds are reproducible, pinning package manager versions via lockfiles (`package-lock.json`, `pnpm-lock.yaml`, or container SHA).
- [ ] **Zero-Downtime Rollout & Fast Rollback:** Deployment platform (Vercel, Firebase Hosting, Cloud Run, ECS) supports instant rollback to the previous immutable release with one click or command.

## 7. AI & LLM Feature Guardrails (If Applicable)
- [ ] **Structured Output Validation:** LLM responses are parsed through strict JSON schemas with fallback error handling rather than assuming raw text matches format expectations.
- [ ] **Token Budget & Latency Caps:** Prompt inputs are truncated or bounded, and max token limits are enforced to avoid runaway billing and HTTP gateway timeouts.
- [ ] **Prompt Regression Testing:** Prompt changes are benchmarked against an evaluation suite before updating production system prompts.

---

### Need an Objective Review of Your Codebase?
Adam Blansett provides fixed-scope **48-Hour Codebase & Production-Readiness Audits** and senior technical consulting for high-growth startups and established engineering teams.

- Website: https://adamblansett.com
- Schedule an Assessment: https://adamblansett.com/book/
- Direct Inquiry: https://adamblansett.com/contact/