Deployment and Security Checklist
Deploy the web and admin apps with explicit migrations, cron, readiness, trusted networking, and production security controls.
Synced with starter commit
7d452a6.
Deploy the web app and apps/admin as separate services with separate origins. Use Node >=20.19.0 <23 and pnpm 10.22.0, run pnpm lint, pnpm test:cov, and pnpm build, then apply database migrations explicitly with pnpm db:check:prod and pnpm db:migrate:prod. Migrations are never an automatic build step.
Required Production Controls
- Strong
BETTER_AUTH_SECRET, correct public/auth URLs, production PostgreSQL, and backups with restore drills. - Redis-backed distributed rate limiting and an explicitly trusted client-IP header/source.
- Turnstile for protected auth flows; demo flags and development auth-link logging disabled.
CRON_SECRETand a five-minute schedule for/api/cron/jobs(the includedvercel.jsonprovides the schedule).- Stripe live keys, verified webhook, safe Billing Portal configuration, and configured Price IDs when billing is enabled.
- Private S3-compatible objects, least-privilege credentials, correct CORS, and short signed URLs when storage is enabled.
- Verified email domain and data-retention/legal policy reviewed for your jurisdiction.
Use /api/health for liveness and /api/ready for deployment readiness. The latter checks environment, database, migration state, Redis, and queue health; a degraded queue is an operational signal even if requests still serve.
Security headers include production HSTS and a report-only CSP path. Observe CSP reports before enforcing a policy compatible with your analytics, captcha, payments, and storage hosts. After deploy, smoke-test auth, organization isolation, checkout/webhooks, cron jobs, exports/deletion, and admin MFA. Read DEPLOYMENT.md, docs/security-headers.md, and .env.example in the starter before launch.