Free checklist
The Prototype-to-Production Readiness Checklist
You proved the idea with a prototype built in Claude, Cursor, Bolt, or Lovable. Before real users hit it, run this. Twelve things that separate a demo from software that survives Customer Two. Each one is the gap and the one test that tells you if you have it.
-
1. The data model survives a second user
Is everything in one table or a JSON blob, or is the schema actually normalised? The test: two users create data that never collides.
-
2. Auth is real, not hardcoded
No hardcoded login, no gating that lives only in the frontend. The test: a server-enforced session, a working password reset, and a role check that the browser cannot bypass.
-
3. Permissions are enforced on the server
Can a user open someone else's record by changing an ID in the URL? The test: every read and write checks ownership on the server, not in the UI.
-
4. No secrets in the frontend bundle
API keys, database URLs, service tokens. The test: view-source and the JS bundle contain nothing secret. This is the single most common prototype leak.
-
5. Multi-tenant isolation
If you have customers, can Customer A ever see Customer B's data? The test: every query is scoped to the tenant and enforced, not isolated by convention.
-
6. A migration path exists
Can you change the schema without losing data or taking the app down? The test: migrations are versioned and reversible, not "edit the table in the dashboard".
-
7. Input is validated on the server
The test: malformed or malicious input is rejected by the server, not just by the form's required fields.
-
8. Errors are handled, not swallowed
The test: a failed request shows the user something useful and logs the cause. It does not white-screen and leave you guessing.
-
9. Rate limits and abuse controls
The test: someone cannot hammer your sign-up or your API for free. There is a limit, a cost ceiling, or a check standing in the way.
-
10. Backups you have actually restored
The test: not "the platform backs up". You have restored one and confirmed the data came back intact.
-
11. You can see what broke without a user telling you
The test: when something fails at 2 am, logs and error tracking show you what and where. Observability, not vibes.
-
12. It can onboard Customer Two without you
The test: a new customer signs up, pays, and uses it without you touching the database. If not, you have a demo, not a product.
Want the printable version?
Get the one-page printable checklist plus a short companion note on how we close each gap when we take a prototype to production. No newsletter spam. Unsubscribe in one click.
Already past the checklist and breaking under real users?
That is the work we do: rebuilding AI-built prototypes database-first so they hold up in production. Thirty minutes, no pitch. We tell you honestly whether you need us.
Book a free discovery call