Understand the application
- Identify every framework, runtime, dependency, database and external service.
- Confirm the business owns or is licensed to use included code, fonts, images and data.
- Remove placeholder text, sample users, test routes and unused demonstration features.
- Document how to install, build, start, back up and restore the application.
Complete the security review
- Validate and authorise every server-side action, not only the user interface.
- Protect sign-in, password reset, file upload and administrator functions.
- Use prepared database queries or a trusted data layer and encode output correctly.
- Set secure cookie, session, CORS and security-header behavior for the real domain.
- Scan dependencies and remove packages that are unnecessary, abandoned or unexpectedly privileged.
Check data and privacy
- Collect only the personal data the service needs and state why it is collected.
- Keep production data out of development and AI prompts.
- Define retention, deletion, backup and access rules for customer data.
- Confirm analytics, cookies, email and payment integrations match the published policies.
Test production behavior
- Run a clean production build using the locked dependency versions.
- Test the application at mobile and desktop sizes using the production domain and HTTPS.
- Test authentication, validation, email, payments, uploads and error states that apply.
- Restart the application and confirm it recovers without local development tools.
- Check logs, storage, resource limits and backup completion.
- Run the health check from outside the server.
Prepare the release and rollback
- Deploy an identified commit or release archive.
- Back up the application and database before a destructive migration.
- Keep the previous working release available.
- Write the exact verification steps and the condition that triggers rollback.
- Monitor the first production traffic and error logs instead of assuming a successful upload means a successful release.
Official references
Platforms and tools change over time. Use these official references for the current product documentation.