Skip to content
Back to blog

What “production-ready” really means: a 10-point checklist

Every developer has heard "it works on my machine". Production-ready means it also works at 3 a.m. on a Sunday, with real users, real data and nobody watching. This is the checklist we use for every project, whether it is a website, a web app or an AI agent.

Security

  1. Authentication and roles. Strong login, sessions that expire, and users only see what their role allows. Checked on the server, never just hidden in the UI.
  2. Input is never trusted. Every form and API validates and limits input, and public forms are protected against spam and abuse with rate limits.
  3. Secrets stay secret. No passwords or API keys in the code repository. The app refuses to start when a required secret is missing instead of silently using a default.

Releases

  1. Automated tests. Not 100% coverage, but the critical paths (login, payment, the main workflow) are tested on every change.
  2. CI/CD. Every merge is built, tested and deployed the same way. No manual steps over SSH that only one person knows.
  3. Staging. A copy of production where changes are checked before real users see them.

Operations

  1. Monitoring and alerts. Errors are tracked with a tool like Sentry, and someone gets an alert before customers start emailing.
  2. Backups that are tested. A backup you have never restored is a hope, not a backup. Schedule them, copy them off the server, and try a restore.
  3. Logs and audit trail. When something goes wrong, you can see what happened and who did what.

Ownership

  1. Documentation and handover. A README that explains how to run, deploy and update the system. If your developer disappears tomorrow, someone else can take over.

Why this matters for your budget

Skipping these points makes the first version slightly cheaper and every version after that more expensive. Outages, data loss and "nobody dares to touch it" code cost far more than doing it properly from the start.

That is why these ten points are included in every Noordiq project by default, not sold as an extra. Want to know how your current system scores? Book a free intro call.