The most useful word my checklist prints is UNKNOWN

Farzam Habibi — Sat, 12 Sep 2026 13:43:57 +0000

I shipped a release last week and checked it twice.

The registry had the new version. The pinned CDN link had the new file. Then I checked the link people actually install from, the one with @latest in it, and it was still serving the previous release. Same path, different content, no error anywhere.

Every check I ran was green. That is the failure I care about most: the one where nothing throws, nothing pages you, and every signal says fine.

There is no pass state, on purpose

I maintain prodcheck, a free and open source list of 4,372 things to check before you ship. Security, performance, scale, integrations, and the post-launch parts that rarely make it onto a checklist.

When something runs it, each item can come back exactly three ways:

FINDING, with the file and line that is wrong
UNKNOWN
N/A, with a reason

There is no pass, and that is deliberate. A tool reading your repo cannot know that your backups restore, that your on-call rotation answers, or that the check you mocked in a test is wired up in production. The honest answer is usually that nobody has checked this yet, and a checklist that turns that into a green tick is worse than no checklist, because now you have a document telling you that you are safe.

UNKNOWN is a first class answer for the same reason. It stays visible, it keeps its name, and a person has to close it.

Five that catch people most often

Restore from backup end to end, into a usable environment, at least once. Plenty of teams never have, and restore time at ten times the data is a different number.
Validation errors that leak stack traces, SQL, filesystem paths or internal service names to whoever is poking at your form.
Producers and consumers that can be deployed in either order, because during a rollout both orders happen.
A rollback that does not need the person who deployed it to be awake.
Token checks that verify issuer, audience, expiry, signature algorithm and key, not just that a signature exists.

The 12 percent nobody mentions

3,830 of the 4,372 items are stack agnostic, which is 88 percent. The rest are not, and pretending otherwise is how a generic checklist wastes your afternoon. 26 stacks have their own supplement, so the Next.js items stay out of your way while you are shipping Django.

Three ways to run it

As an MCP server in Claude Code: claude mcp add prodcheck -- npx -y --package=prodcheck prodcheck-mcp
Inside a repo: npx prodcheck init, which drops a review skill next to your code
As a prompt pasted into any chat window

Free, open source, no account. Content is CC BY 4.0, code is MIT.

Where it came from, honestly

It started as our own pre-launch audit at Arioo, and a lot of it was expanded with heavy AI help. That is exactly why the file and line rule exists. A model will happily tell you something is fine. The rule is the only thing that makes it show you where it looked.

https://github.com/FarzamHabibi/pre-production-checklist