Launch Readiness Checklist

Your prototype works. That is not the same as safe to sell. Test the narrow path from account access to paid entitlement — Supabase Row Level Security, server-created checkout, signed webhooks, duplicate delivery, and refunds.

Mark a check only when you reproduced it against the exact revision and environment you plan to sell, and saved the evidence. An untested check is not a pass.

Never paste live secrets, tokens, customer data, or full webhook secrets into screenshots or shared logs.

Reading the result

All 20 marked means MONEY-PATH CHECKS PASSED for the commit and environment you tested — save the evidence with the release and rerun when auth, database policies, checkout, webhook handling, or entitlement logic changes. Any unmarked check means LIVE SALES BLOCKED: keep the smallest reproduction, fix it, and rerun that section.

Scope limit. This checklist examines a narrow purchase path. Passing it does not certify the app as secure and does not replace a broader security, privacy, legal, backup, monitoring, or incident-response review.

Found a red test? Keep the reproduction. The ShipTested public example turns three of these failures — RLS isolation, redirect-based access, and duplicate webhook delivery — into runnable red/green tests. Clone it, break it, run it.

Run the public example →

Launch Readiness Checklist

ATest setup

BSupabase RLS

CCheckout creation

DWebhooks and entitlement

Reading the result