Shipping Checklist - Don't Go Live Without This

Before deploying to production, verify EVERY item. Block the deploy if critical items fail.

Web (Next.js + Supabase + Vercel)

Security (CRITICAL - block deploy if failing)

• RLS enabled on ALL Supabase tables (query: SELECT tablename FROM pg_tables WHERE schemaname='public' AND rowsecurity=false)
• No USING (true) on write policies
• .env.local in .gitignore (check: git ls-files .env*)
• No hardcoded API keys in code (search: grep -r "sk_\|key_\|secret" --include="*.ts" --include="*.tsx")
• NEXT_PUBLIC_ vars are safe to expose (anon key OK, service_role NOT OK)
• Webhook signature verification on Polar endpoint

Environment

• All env vars set in Vercel (production AND preview)
• Supabase URL/Key match production project (not local)
• Auth redirect URLs include production domain in Supabase dashboard