2026-11-01
A checklist for Next.js, Supabase, and Vercel apps before the first real customer.
RLS on every exposed table. Policies compare auth.uid() to a membership row. Service-role key only on the server. Storage policies reviewed. Auth redirect URLs locked to production domains. Dependency audit clean of critical CVEs you intend to ship.
Indexes for every filter on a hot table. No N+1 across server components on the main route. Timeouts and retries on outbound model calls. Rate limits on public endpoints. Migrations run in a way you can roll back.
Core Web Vitals targets: LCP within 2.5s, INP within 200ms, CLS within 0.1 at the 75th percentile. A Lighthouse score is a hint, not the field metric.
Error monitoring is on. You know who gets the alert. Logs do not contain tokens. A staging environment exists. The README explains how to deploy. Someone other than the original author can roll back.