Pre-Deploy Checklist

Hardcoded secrets are pushed to GitHub and stolen by bots within 30 seconds.

If .env is committed, your database password, API keys, and JWT secret are public.

New developers need to know which env vars are required without seeing real values.

Running without DATABASE_URL silently fails. Crashing early prevents data loss.

Source maps expose your entire codebase to anyone who opens DevTools.

Plain text or MD5 passwords are cracked in seconds with rainbow tables.

Tokens without expiry are valid forever — one leaked token = permanent access.

JWT secret in code lets anyone forge admin tokens.

Without rate limiting, attackers try millions of passwords per hour.

One SQL injection gives attackers full database access — all user data, payments, everything.

Missing auth check = anyone can access admin endpoints by guessing the URL.

Unvalidated input is the root cause of 90% of security vulnerabilities.

CORS: '*' lets any website make requests to your API as your logged-in user.

Renders raw HTML = attackers inject scripts that steal cookies and sessions.

Missing headers allow clickjacking, MIME sniffing, and XSS amplification.

HTTP resources can be intercepted and modified by anyone on the network.

Console logs in production leak internal data and slow down the app.

Debug mode exposes stack traces with internal file paths and technology details.

Stack traces tell attackers your exact framework, file structure, and dependencies.

Known CVEs in your dependencies are the easiest way for attackers to get in.