Objective
Your mission
Run both checklists and the ship/no-ship framework on your capstone project. Output: full_checklist_run.md.
You need: A built capstone project (from Lesson 02).
Time: 30 minutes.
Step 1: run the pre-deployment checklist (10 min)
The checklist is your safety net
You've been building with review habits — catching red flags, verifying claims, testing features. The checklists are the final safety net. They catch anything you missed during building. Run them every time, even when you're 'sure' everything is fine.
Write in your file:
## Pre-Deployment Checklist (10 Points)
### 1. Environment variables set on platform
Status: [Pass/Fail]
Evidence: [e.g., "All vars from .env added to Vercel"]
### 2. No hardcoded secrets in code
Status: [Pass/Fail]
Evidence: [e.g., "grep -r 'sk_\|eyJ\|password\|secret\|key=' src/ — clean"]
### 3. RLS enabled on all database tables
Status: [Pass/Fail]
Evidence: [e.g., "Checked Supabase dashboard — all 3 tables have RLS"]
### 4. Error handling in place
Status: [Pass/Fail]
Evidence: [e.g., "All supabase.from() calls have if(error) check"]
### 5. Loading states on data-driven components
Status: [Pass/Fail]
Evidence: [e.g., "All 3 data components show loading skeleton"]
### 6. Auth checks not commented out
Status: [Pass/Fail]
Evidence: [e.g., "grep -r '// if (!user)' src/ — nothing found"]
### 7. Tested on mobile viewport
Status: [Pass/Fail]
Evidence: [e.g., "Tested at 375px — layout works"]
### 8. No console.log statements
Status: [Pass/Fail]
Evidence: [e.g., "grep -r 'console.log' src/ — clean"]
### 9. Favicon and meta tags set
Status: [Pass/Fail]
Evidence: [e.g., "index.html has title, description, favicon"]
### 10. Full user flow tested end-to-end
Status: [Pass/Fail]
Evidence: [e.g., "signup → login → CRUD → logout all work"]
Step 2: run the security checklist (7 min)
Write in your file:
## Security Checklist (7 Points)
### 1. RLS on ALL tables
Status: [Pass/Fail]
Evidence: [checked every table?]
### 2. No service_role key in frontend
Status: [Pass/Fail]
Evidence: [e.g., "grep -r 'service_role' src/ — clean"]
### 3. Input validation on all user inputs
Status: [Pass/Fail]
Evidence: [e.g., "All forms have required, length, format checks"]
### 4. Rate limiting on auth endpoints
Status: [Pass/Fail]
Evidence: [e.g., "Supabase auth settings verified"]
### 5. CORS configuration
Status: [Pass/Fail]
Evidence: [e.g., "Restricted to your domain(s) in Supabase settings"]
### 6. CSP headers
Status: [Pass/Fail]
Evidence: [e.g., "Configured on Vercel/Netlify"]
### 7. SQL injection prevention
Status: [Pass/Fail]
Evidence: [e.g., "Using Supabase JS client — parameterized by default"]
Step 3: fix all failures (5 min)
Fix every failed check before proceeding.
Write in your file:
## Fixes Applied
1. [check number]: [what was wrong] → [what you fixed]
2. [check number]: [what was wrong] → [what you fixed]
[or "No failures found"]
## Re-Run Confirmation
Failed checks re-run: [list]
All now passing: [yes/no]
Step 4: run the ship/no-ship framework (5 min)
Write in your file:
## Ship/No-Ship Framework
1. Can users access other users' data? [yes/no] → [RED/GREEN]
2. Are secrets exposed in code? [yes/no] → [RED/GREEN]
3. Does core flow work end-to-end? [yes/no] → [GREEN/RED]
4. Are critical errors handled? [yes/no] → [GREEN/RED]
5. Have you tested on mobile? [yes/no] → [GREEN/YELLOW]
6. Is UI rough but functional? [yes/no] → [GREEN/YELLOW]
7. Are non-core features broken? [yes/no] → [GREEN/YELLOW]
Step 5: verify minimum viable security (3 min)
Write in your file:
## Minimum Viable Security
1. RLS enabled on all tables: [yes/no]
2. No service_role key in frontend: [yes/no]
3. No hardcoded secrets: [yes/no]
4. Auth working and tested: [yes/no]
5. Error handling on critical paths: [yes/no]
6. Full user flow tested: [yes/no]
All 6 met: [yes/no]
Step 6: make the decision (2 min)
Write in your file:
## Decision
Red lights: [list or "none"]
Yellow lights: [list or "none"]
Final decision: [SHIP / SHIP WITH CAUTION / NO SHIP]
Reasoning: [2-3 sentences]
Your pre-deployment checklist passes, but the security checklist finds a table without RLS. What happens to the ship decision?
Other users' data being reachable is a red light. Fix it, re-run the failed checks, then make the ship call.