Production-ready means predictable under failure, observable, and secure by default.
Checklist
Security
- Secrets only in env/secret manager; never committed
- Dependencies audited; critical updates applied
- Security headers (CSP when viable, HSTS, etc.)
- Authz on all sensitive routes
- Uploads and inputs validated; size limits
- CORS and cookies with least privilege
Reliability
- Health/readiness endpoints
- Timeouts and retries with backoff on external I/O
- Circuit breaker or graceful degradation where critical
- Safe migrations in the deploy pipeline
- Documented rollback plan
Observability
- Structured logs with request id
- Correct levels; no PII/secrets
- Error tracking (Sentry or project equivalent)
- Metrics: latency, error, saturation
- Actionable alerts, not noise
Configuration
- Env validated at boot (schema)
- Clear separation: local / staging / prod
- Feature flags for risky changes when they exist
- Reproducible build; version/commit at runtime
UX under failure
- Useful error pages/states
- No stack traces to the user
- Rate limit and clear messages on abuse paths
Deploy
- Typical order: migrate → deploy app → verify health → smoke test.
- Blue/green or canary when the project already has it.
- Do not make untracked manual hotfixes in prod.
- GitHub pipeline:
github-actions. Mobile stores:github-actions-android/github-actions-ios. Mac:github-actions-macos. Watch:github-actions-watchos. - Slow work:
background-jobs. HTTP callbacks:webhooks. Cache:redis-cache.
Anti-patterns
- “Works on my machine” without smoke testing in staging
- Logs that become a dump of body with tokens
- Alerts without an owner
- Irreversible deploy without backup/migrate down strategy
Definition of done
- Critical checklist marked
- Smoke test of the main flow ok in the target environment
- Errors visible in the staging/prod error tracker
- Rollback known
- Secrets and env validated