I shipped a release last week and checked it twice.
The registry had the new version. The pinned CDN link had the new file. Then I checked the link people actually install from, the one with @latest in it, and it was still serving the previous release. Same path, different content, no error anywhere.
Every check I ran was green. That is the failure I care about most: the one where nothing throws, nothing pages you, and every signal says fine.
There is no pass state, on purpose
I maintain prodcheck, a free and open source list of 4,372 things to check before you ship. Security, performance, scale, integrations, and the post-launch parts that rarely make it onto a checklist.
When something runs it, each item can come back exactly three ways:
-
FINDING, with the file and line that is wrong UNKNOWN-
N/A, with a reason
There is no pass, and that is deliberate. A tool reading your repo cannot know that your backups restore, that your on-call rotation answers, or that the check you mocked in a test is wired up in production. The honest answer is usually that nobody has checked this yet, and a checklist that turns that into a green tick is worse than no checklist, because now you have a document telling you that you are safe.
UNKNOWN is a first class answer for the same reason. It stays visible, it keeps its name, and a person has to close it.
Five that catch people most often
- Restore from backup end to end, into a usable environment, at least once. Plenty of teams never have, and restore time at ten times the data is a different number.
- Validation errors that leak stack traces, SQL, filesystem paths or internal service names to whoever is poking at your form.
- Producers and consumers that can be deployed in either order, because during a rollout both orders happen.
- A rollback that does not need the person who deployed it to be awake.
- Token checks that verify issuer, audience, expiry, signature algorithm and key, not just that a signature exists.
The 12 percent nobody mentions
3,830 of the 4,372 items are stack agnostic, which is 88 percent. The rest are not, and pretending otherwise is how a generic checklist wastes your afternoon. 26 stacks have their own supplement, so the Next.js items stay out of your way while you are shipping Django.
Three ways to run it
- As an MCP server in Claude Code:
claude mcp add prodcheck -- npx -y --package=prodcheck prodcheck-mcp - Inside a repo:
npx prodcheck init, which drops a review skill next to your code - As a prompt pasted into any chat window
Free, open source, no account. Content is CC BY 4.0, code is MIT.
Where it came from, honestly
It started as our own pre-launch audit at Arioo, and a lot of it was expanded with heavy AI help. That is exactly why the file and line rule exists. A model will happily tell you something is fine. The rule is the only thing that makes it show you where it looked.
https://github.com/FarzamHabibi/pre-production-checklist
If a check bit you once and it is not in the list, that is the thing I actually want to hear.
Top comments (0)