Production Readiness Checklist by stack

A prototype that works on your screen is not the same as an app that can take real users, real money and real mistakes. This checklist lists what usually separates the two, adjusted for the stack you built on. Choose a stack, work through the items, and export the result to share with your developer or keep with your project notes. Ticks are saved in this browser only.

Stacks covered

• Lovable / Supabase: generated React front ends on a Supabase back end.
• Next.js: custom web apps and SaaS products.
• Bubble: visual apps with the built-in database and workflows.
• WordPress: sites and WooCommerce stores.
• Shopify: stores with themes and apps.
• Flutter: mobile apps heading for the app stores.

Each stack shares a common core and adds items specific to that platform.

What the sections cover

• Authentication: sign-up, password reset and email verification work end to end; admin accounts use strong sign-in and two-factor login where offered.
• Payments: live keys are separate from test keys, webhooks are verified, and a failed or refunded payment leaves the app in a sensible state.
• Environment variables: every secret lives in the host's settings, not the code, and nothing secret is exposed to the browser.
• Backups: you know what is backed up, how often, where, and you have actually tried a restore.
• Error tracking and logs: errors reach a place someone checks, not only the browser console.
• SEO and sharing: page titles, descriptions, a sitemap, sensible URLs and preview images for social shares.
• Legal pages: privacy policy, terms, cookie notice where required, and a way for users to contact you.
• Ownership: domain, hosting, app store and payment accounts are registered to you, not to a former developer.

Stack-specific points worth knowing

Lovable / Supabase. Row level security must be on for every table in the public schema, and the service-role key must never appear in front-end code. Run your SQL through the Supabase RLS Checker and your code through the Secret Leak Scanner. Check which backups your Supabase plan includes rather than assuming.

Next.js. Any variable starting with NEXT_PUBLIC_ is bundled into the browser code. Confirm that server-only values do not carry that prefix, that API routes check who is calling, and that preview deployments do not use production data.

Bubble. Privacy rules control who can see each data type; without them, data can be searchable by anyone. Check that the live version, not only the development version, has the changes you expect, and that API workflows exposed to the public are meant to be.

WordPress. Remove unused plugins and themes, keep core and plugins updated, remove admin accounts nobody uses, and make sure off-site backups include both files and the database.

Shopify. Review installed apps and their permissions, remove staff accounts that are no longer needed, and duplicate your theme before editing so you can roll back.

Flutter. Store your Android signing key and its passwords somewhere safe and owned by you, because losing it complicates future updates. Check release builds, not debug builds, and prepare store listings, privacy details and test accounts for reviewers.

How to read your progress

The progress bar shows how many items you have resolved, but not all items weigh the same. An unchecked item in authentication, environment variables or backups is a launch blocker. An unchecked SEO item is something to fix in the first weeks. If several blockers are open, launching to a small group first is safer than a public launch.

Exporting and sharing

Use Export Markdown to download the checklist with your ticks and notes, or Print to save it as a PDF from your browser's print dialog. The export is a good attachment for a handover, or a starting point when you brief a developer.

Limitations

The checklist is a structured reminder. It does not look at your code, your hosting or your store, so it cannot tell you whether an item is really done. Results are guidance, not a security audit.

Going further

For the reasoning behind each item, read the prototype to production checklist and why Lovable, Bolt and v0 apps break in production. For WordPress and Shopify, see what to check first in a takeover. For Bubble or FlutterFlow, fix or rebuild helps you decide how much work is reasonable.

Too many open items?

If the list keeps growing, or a store keeps rejecting your build (app store rejection help), it may be time for another pair of hands. Post your takeover for free and attach your exported checklist, so developers can see exactly what is left.