From Localhost to Production
The gap between "it works on my machine" and "it works in production" is where most startups lose weeks. Here's the deployment checklist we follow at AY Labs.
Infrastructure
- Environment separation: Dev, staging, and production are isolated
- Secrets management: No hardcoded credentials, use a vault
- SSL/TLS: Every endpoint uses HTTPS, no exceptions
- Domain and DNS: Configured with proper TTL and failover
Application
- Health checks: /health endpoint returns service status
- Logging: Structured logs with correlation IDs
- Error tracking: Sentry or equivalent, configured with source maps
- Database migrations: Automated and reversible
Monitoring
- Uptime monitoring: External pings every 60 seconds
- Performance monitoring: Response times, error rates, throughput
- Alerting: PagerDuty or Slack alerts for anomalies
- Backup verification: Backups are tested monthly, not just scheduled
Security
- Rate limiting on all public endpoints
- CORS properly configured (not `*`)
- SQL injection and XSS protections verified
- Dependency vulnerabilities scanned (npm audit, Snyk)
Why This Matters
We've seen startups lose customer data because backups weren't tested. We've seen APIs go down because health checks weren't configured. Every item on this list exists because we've seen the failure mode in the wild.