A Production Readiness Checklist for Startups

Production readiness is easier to reason about as a checklist than as a feeling. The list below is the shape we use when reviewing a product before it takes on real users.

Architecture

• Responsibilities are separated and documented at a high level.
• No single component is required for every unrelated feature.
• Known scaling limits are written down.

Code and quality

• Automated tests cover the critical business paths.
• Type checks and linting run on every change.
• Code review is required before merge.

Security

• Authentication and authorisation are enforced server-side.
• Secrets are stored outside the codebase and rotated.
• Input is validated at the boundary; dependencies are scanned.

Data

• Migrations are versioned and reversible.
• Backups exist and a restore has actually been tested.
• Personal data is identified and access is limited.

Infrastructure, operations and delivery

• Environments are separated and reproducible.
• CI/CD deploys automatically with a rollback path.
• Logs, metrics and alerts exist for the paths that matter.
• Someone is responsible when an alert fires.