The Production Readiness Checklist Every Indie Hacker Should Run Before Launch

You're an indie hacker. You've built the thing. It works on your machine. You're this close to shipping.

Stop. Run a production readiness review first.

Not the 200-item enterprise SRE checklist — you don't have an SRE org and you don't need one. But the 20% that actually matters? That's the difference between "launched" and "launched, then immediately paged at 3am."

The 20% that actually matters

Here's the reality check: for a solo or small-team project, the items that genuinely matter on day one are:

1. Input sanitization — every input is an attack surface. Validate, sanitize, escape. No exceptions.
2. HTTPS everywhere — free with Let's Encrypt / Vercel / Cloudflare. No excuse.
3. Secrets not in git — use environment variables, use a secrets manager, never commit .env. Rotate the one you accidentally committed. Yes, that one.
4. Auth done right — hashed passwords (bcrypt/argon2), secure cookies, rate-limited login. Don't roll your own crypto.
5. Rate limiting on forms and APIs — a single unfocused scraping script will take you down. Cloudflare or a middleware limiter, free tier is fine.
6. Basic error handling — a global error boundary, a 500 page that doesn't leak stack traces, and something that tells you when things break (even an email is better than nothing).
7. Backups — and a tested restore. An untested backup is a prayer, not a backup.
8. A privacy policy — if you collect any user data at all (you do), you need one. Required for AdSense, app stores, and basic legal hygiene.

That's it. That's the bar for "shipped responsibly." Everything else — distributed tracing, chaos engineering, blue-green deploys, SBOMs — is genuinely good and worth aspiring to, but treating it all as a hard gate for every project means you never ship anything.

The 12-category framework

For the curious (and for when you grow), the full checklist spans twelve categories:

1. Security — input validation, headers, secrets, dependency scanning, rate limiting
2. Auth & Access Control — hashing, MFA, JWT, RBAC, sessions
3. Data, Privacy & Compliance — PII, GDPR/CCPA, backups, migrations
4. Testing — unit, integration, E2E, load, chaos, CI gates
5. Reliability & Resilience — retries, circuit breakers, health probes, DR
6. Performance & Scalability — caching, indexing, CDN, autoscaling
7. Observability & Operations — logging, metrics, alerting, tracing, SLOs
8. CI/CD & DevOps — IaC, env parity, blue-green, rollback, feature flags
9. Documentation & Architecture — diagrams, OpenAPI, ADRs, runbooks
10. Accessibility & UX — WCAG, keyboard, ARIA, i18n
11. Business / Legal — billing, idempotent payments, fraud, support
12. Cost — FinOps, autoscaling limits

The genius of structuring it this way is that you can filter by stack. A static marketing site doesn't need distributed tracing. A CLI library doesn't need a cookie consent banner. A multi-tenant SaaS needs all of it.

Run it interactively

Rather than read a 92-item wall of text, the better move is to use the ShipReady checklist generator. Pick your stack, get a filtered view, check items off as you go, and export the result as a shareable artifact. "Here's what we verified before launch" is a genuinely useful document to hand an investor, a customer, or your future self at 3am.

Ship with confidence, not crossed fingers

The goal isn't perfection. The goal is intentionality — knowing what you've covered, what you've deferred, and why. A deferred item with a noted reason is a plan. A deferred item you forgot about is a postmortem waiting to happen.

Run the checklist. Note what you're skipping and why. Ship. Sleep.