The Last Mile pre-launch checklist: free preview
The non-negotiables from the quick start, plus 15 of the 100 checks in the full pack. Paste any of them into your AI coding agent and ask it to audit, not fix.
Short on time? The non-negotiables
- □ 1.1No secrets in source
- □ 1.2Leaked keys rotated
- □ 1.4No secret keys in the browser
- □ 1.8Keys pasted into AI chats rotated
- □ 2.1Server-side auth on every route
- □ 2.2Users can't read others' data
- □ 2.3RLS / rules on every table
- □ 3.1Server-side input validation
- □ 8.2Fulfil from webhooks only
- □ 8.3Webhook signatures verified
- □ 11.3One tested restore
- □ 12.1Uptime alert on your phone
- □ 12.4Spend caps on paid APIs
- □ 14.2AI can't act without permission checks
- □ 14.4AI output treated as untrusted
15 sample checks
- 1.1Search the whole repo for API keys, tokens, passwords, private keys and database connection strings. Nothing secret lives in source files.
- 1.4Only public-safe values use client prefixes (
NEXT_PUBLIC_,VITE_,PUBLIC_,EXPO_PUBLIC_). Secret keys, service-role keys and webhook secrets are read only in server code. - 1.5Open the deployed site, view the JS bundle and network tab, and search for
sk_,secret,service_roleand your provider key prefixes. Nothing turns up. - 2.1Every API route, server action and server-rendered page that touches user data checks the session on the server. Hiding a button is not access control.
- 2.2Users can only read and change their own records. Test it: log in as user A, copy a request, swap in user B's ID. It must fail.
- 2.6Login, signup, password reset, and any endpoint that costs you money (AI calls, emails, SMS) are rate limited.
- 3.1Every input is validated on the server with a schema (zod, valibot, pydantic, etc.). Client-side validation is a UX nicety, not protection.
- 3.9User and AI-generated content is rendered safely. No
dangerouslySetInnerHTML,v-htmlorinnerHTMLwith unsanitized content. Markdown renders with raw HTML off. User-supplied links blockjavascript:URLs. - 4.3Users see a short, actionable message. Stack traces and raw error objects never reach the browser in production.
- 5.1Run Lighthouse (mobile) on your landing page and main app page. Fix anything flagged red before launch.
- 6.1A clean production build passes locally (
npm run buildor equivalent). Type and lint errors are fixed, not suppressed. - 8.2Access is granted from a verified webhook event (e.g.
checkout.session.completed), not from the success page loading. - 11.3You've done one test restore into a scratch database and confirmed the app runs against it.
- 12.4Spending alerts or hard caps are set on AI APIs, hosting and database. Per-user limits stop one user from running up your bill.
- 14.4Model output is untrusted. It is sanitized before it renders as HTML or markdown, and validated before it touches a query, a shell command, a file path, a URL or a redirect. Structured output is checked against a schema.
Want the other 85 checks and all 43 prompts?
The full kit has every check across 14 sections, a prompt for each area, Ground Rules that stop your agent from "fixing" what you didn't ask about, and a launch-day run order.
Get new checks by email
$ subscribe --launch-notes # new checks, prompts and shipping tips for vibe coders. No spam.
Not legal, tax or security advice. Checking every box lowers your risk. It does not guarantee your app is secure.