Launch Checklist

Run through every item before the first deploy to Vercel. A failed item is a blocker.

The checklist is grouped by concern: Security, Build, GitHub → Vercel, Documentation.

Security

• ☐ .claude/settings.json created and committed to the repo
• ☐ .claude/ is NOT listed in .gitignore
• ☐ .env.local is in .gitignore and has never been committed
• ☐ .env.example is committed with empty values only
• ☐ No API key values are hardcoded anywhere in source files
• ☐ SUPABASE_SERVICE_ROLE_KEY is only accessed server-side
• ☐ No secret keys are prefixed with NEXT_PUBLIC_
• ☐ All external API calls live in Server Components or Route Handlers
• ☐ CLAUDE.md includes the Environment & Secrets rules section
• ☐ All secret keys in Vercel dashboard are marked as Sensitive (April 2026 breach mitigation)

Build

• ☐ npm run build passes with zero errors
• ☐ npm run lint passes with zero errors
• ☐ No placeholder copy remains — all real content is in place
• ☐ Mobile layout verified at 390px viewport width
• ☐ Desktop layout verified at 1440px viewport width

GitHub → Vercel

• ☐ git remote add origin [url] completed
• ☐ git push -u origin main completed
• ☐ Vercel project is linked to the GitHub repo
• ☐ All environment variables entered in Vercel dashboard
• ☐ All secret environment variables toggled as Sensitive in Vercel
• ☐ Vercel build succeeded on first deploy

Documentation

• ☐ CLAUDE.md reflects the current state of the project
• ☐ memory.md has entries for all major decisions
• ☐ PLAN.md exists at the project root

🚀 Ready to ship

Every push to main auto-deploys to Vercel. Your .env.local, the Vercel Sensitive environment variables, and the Supabase dashboard are the only places real key values ever exist.