Vibe-Coded to Production: The 14-Point Checklist I Run Before Every Launch

· Builds

AI can generate the app in an afternoon. It cannot tell you what you forgot. The exact 14 checks I run before any AI-assisted build goes live.

Last updated: August 3, 2026 · 8-minute read

Generating a working app is now the easy part. I've shipped enough AI-assisted builds to know exactly where they break, and it's never the feature code — it's the twelve boring things nobody prompts for.

This is the checklist I run before anything goes live. It takes about 45 minutes and it has saved me from every one of these mistakes at least once.

Security (the four that actually bite)

1. No secrets in client code. Grep before you deploy — this catches more than you'd think:

Anything a browser can download is public. An "anon" or "publishable" key is fine; a service key is a breach.

2. Row-level security is on, and tested as a logged-out user. AI-generated backends love to create a table and forget the policy. Open an incognito window and try to read data you shouldn't see. If it works, you have a leak, not a feature.

3. Server-side authorisation, not client-side. if (user.isAdmin) in React is a suggestion. The check has to live where the data does. Roles belong in their own table, never on the profile row.

4. Input validation on the server. Zod on the client is UX. Zod in the handler is security.

Correctness

5. Every route loads on a hard refresh. SPA deep links are the single most common AI-build bug. Open each route in a new tab, not by clicking through the nav.

6. The empty state and the error state exist. Generated UIs assume the happy path and a full database. Turn off the network and look at the page.

7. Forms handle double-submit. Disable on submit, or you will get duplicate rows on the first slow connection.

8. Dates and money aren't floats or strings. Fix this before there's data, not after.

Performance

9. Images are sized and lazy. Explicit width/height on every image kills layout shift; loading="lazy" on everything except the hero. This one check usually moves CLS from "poor" to "good" on its own.

10. The bundle isn't hiding a 400KB chart library you use on one page. Route-level code splitting is two lines:

11. Core Web Vitals measured, not assumed. LCP ≤ 2.5s, CLS ≤ 0.1, INP ≤ 200ms on mobile. I run this on a schedule — the setup is in DevOps without DevOps.

Discoverability

12. Real title and meta description per page. Not "My App". Under 60 and 160 characters respectively. If your framework is client-rendered, this needs per-route head management, not a static tag.

13. robots.txt, sitemap.xml, and canonical URLs exist and agree with each other. A sitemap listing URLs that canonical to somewhere else is worse than no sitemap.

14. Structured data validates. One Organization or WebSite block sitewide, plus Article/Product/FAQPage where they apply. Paste it into the Rich Results Test before you celebrate.

The 45-minute run order

Step 7 matters more than the rest. Preview environments lie — different base URL, different env vars, different caching. Run the route check again against the live domain.

What I stopped worrying about

Test coverage percentages, perfect TypeScript strictness on day one, and "clean architecture" in a project with one developer. They're real concerns at scale and expensive theatre at launch. Ship the checklist above, then earn the rest.

If you want the fast version of the whole loop, Ship a Side Project in One Weekend covers the build side; this post is the part that happens after the demo works.

More builds on the projects page or in the blog archive.