20 checks between your AI-built app and production

Every protected route or page has a server-side check, not just a client-side redirect.

Row-level security (or your database's equivalent) is enabled on every table holding user data.

Session tokens expire and can be revoked — logging out actually logs someone out.

No table allows an authenticated user to read or write another user's rows by default.

Schema changes are tracked in migration files, not just made by hand in a dashboard.

Queries that return lists are paginated — nothing runs an unbounded select on a growing table.

Your client bundle has been searched for API keys, service-role keys, or secrets — none are there.

Development and production use separate credentials and separate databases.

Every form's validation is re-checked on the server, not just in the browser.

File uploads are restricted by type and size on the server, not just the file picker.

Your slowest page has been tested on a throttled connection, not just office wifi.

Database queries used inside a loop have been checked for N+1 patterns.

Errors in production are logged somewhere you'll actually see them, not just the browser console.

You'd know within minutes if the site went down, not when a customer emails you.

Failed states (network errors, empty responses) show the user something other than a blank screen.

Any AI API calls have a rate limit or usage cap, so a bug can't run up a four-figure bill overnight.

Retry logic on external calls has a ceiling — it stops eventually, it doesn't loop forever.

Someone other than you could open this codebase and find the code for a given feature within a few minutes.

There's at least some automated test coverage on the paths that would actually hurt if they broke.

The project builds and deploys through a repeatable process — not "it works because of something I did once on my machine."