Avoiding Deployment Day Disasters
Deploying a web application should be a routine non-event, not a stressful midnight emergency. Over years of launching and rescuing production applications, we have codified this 12-point engineering deployment checklist.
Phase 1: Environment & Secret Management - [ ] **No Hardcoded Secrets**: Scan repositories for raw API keys, private certificates, or database connection strings using tools like `git-secrets` or Trivy. - [ ] **Environment Variable Parity**: Verify that all required variables are set in production with secure production-grade values (distinct from staging and local test keys). - [ ] **Restricted CORS Policy**: Ensure API routes only accept requests from your exact authorized production domains rather than `Access-Control-Allow-Origin: *`.
Phase 2: Database & Connection Architecture - [ ] **Connection Pooling Enabled**: In serverless and containerized environments, configure connection poolers (such as PgBouncer or Supabase Pooler) to prevent ephemeral function instances from exhausting PostgreSQL connection limits. - [ ] **Verified Database Migrations**: Test schema migrations on a staging replica to verify that table locks won't freeze live traffic during cutover. - [ ] **Automated Backups with Retention**: Configure automated daily or continuous WAL backups to external object storage with verified restoration capability.
Phase 3: Security & Network Headers - [ ] **HSTS and Modern SSL**: Enforce `Strict-Transport-Security` with a minimum duration of 1 year and automated Let's Encrypt certificate renewal. - [ ] **Security Headers Configured**: Implement `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and a functional `Content-Security-Policy`. - [ ] **Rate Limiting**: Protect authentication endpoints, password resets, and public contact forms against brute force and automated spam bots with edge rate limiting.
Phase 4: Observability & Monitoring - [ ] **Error Tracking Telemetry**: Initialize Sentry or an equivalent error reporting SDK to capture unhandled exceptions with meaningful stack traces and environment tags. - [ ] **Synthetic Uptime Checks**: Configure independent uptime monitors (e.g. BetterUptime or Uptime Kuma) that ping health endpoints and critical user journeys every 60 seconds. - [ ] **Structured Logging**: Ensure server logs output structured JSON with request IDs to simplify post-incident troubleshooting.
Phase 5: Domain & DNS Verification - [ ] **TTL Pre-Lowering**: If changing DNS records during launch, lower your record TTL to 300 seconds (5 minutes) 48 hours in advance to allow instantaneous rollback if unexpected issues occur. - [ ] **Email DNS Protection**: Double-check that MX, SPF, DKIM, and DMARC records remain untouched during nameserver or DNS changes. - [ ] **Canonical 301 Redirects**: Ensure `http://` redirects to `https://` and non-www redirects cleanly to www (or vice versa) with single-hop 301 redirects.
DevOpsCI/CDDeploymentChecklists