Careeroza

Checklist Before Going Live

Functionality and Security

  • Every Server Action and Route Handler checks auth and validates input (Zod).
  • Data Access Layer returns DTOs; no Prisma rows go straight to Client Components.
  • Webhooks verify signatures; payment status comes from the webhook, never from the browser.
  • Secrets only in server env; NEXT_PUBLIC_ holds nothing sensitive.
  • Security headers (CSP, X-Frame-Options, HSTS) set in middleware or headers() in next.config.ts.

Performance and SEO

  • next build table reviewed: product and category pages are static/ISR, not accidentally dynamic.
  • LCP image has priority; all images have sizes; fonts via next/font.
  • Metadata, canonical URLs, Open Graph images, sitemap.xml, robots.txt, JSON-LD on product pages.
  • Lighthouse mobile score ≥ 90 on home, category and product pages.

Operations

  • CI runs lint, type check, unit tests, build; Playwright smoke test on a preview.
  • error.tsx, not-found.tsx, global-error.tsx exist and look on-brand.
  • Error tracking, uptime monitoring on /api/health, logs with request ids.
  • Database backups and a tested rollback plan (previous Docker image / pm2 previous build).