# Production Readiness Checklist

PATMOS — for teams shipping on Vercel, Supabase, Next.js and AI-assisted builds

Use this checklist before launching to real users. A structured audit from PATMOS covers each area with prioritized remediation.

## Architecture

- [ ] Clear service boundaries and tenancy model documented
- [ ] Failure modes identified (timeouts, retries, partial outages)
- [ ] Environment strategy: dev, staging, production isolated
- [ ] No business logic only enforced on the client

## Data & Supabase

- [ ] Migrations versioned and tested on staging data
- [ ] RLS policies tested per role — not just enabled
- [ ] Backups and recovery procedure documented
- [ ] Indexes reviewed for expected query patterns

## Security

- [ ] Authentication flows reviewed (session, OAuth, magic links)
- [ ] Secrets only in server environment — never client bundles
- [ ] API routes authenticated and rate-limited
- [ ] Dependency audit run on production branch

## Performance

- [ ] Core Web Vitals measured on real devices
- [ ] Caching strategy defined (ISR, tags, CDN headers)
- [ ] Database connection pooling configured
- [ ] Bundle size reviewed — heavy libs deferred or removed

## Observability

- [ ] Structured logging in production
- [ ] Error tracking connected (Sentry or equivalent)
- [ ] Uptime and latency alerts configured
- [ ] Runbook for on-call or launch day

## AI features (if applicable)

- [ ] Prompt injection defenses at API boundary
- [ ] Tool calls validated before side effects
- [ ] Cost and rate limits per user/tenant
- [ ] Human review path for high-risk outputs

---
PATMOS — https://www.patmos.io
Contact: hello@patmos.io