LAUNCH
A launch checklist for software AI wrote.
Before launch: keys out of the browser bundle, authentication enforced on the server, every form validated where it lands, a backup you have restored, limits on public endpoints, and a rollback you have tested. Humanized Code checks all of it for $50 and returns your project marked up against that list, plus a fixed quote, in 48 hours.
01
Before you point a domain at it
Secrets are not in the browser and not in your git history. API keys, database passwords and webhook signing secrets belong in environment variables on the server; anything shipped to the front end is public, permanently, to anyone who opens the developer tools.
Authentication is enforced where the data lives, not where the buttons are. Hiding an admin link is not access control — the URL still works. Every endpoint that returns or changes something checks who is asking, on the server, every time.
Everything a stranger can send you is validated at the point it arrives, including the fields you made a dropdown for. Rate limits sit on login, signup, password reset, contact forms and anything that costs you money per call. You have a database backup, you have restored it once to prove it works, and you know how long that takes. And you can put the previous version back in one action, having done it at least once on purpose.
02
The first hour after launch
Have your logs open. Buy something yourself, with a real card, and follow it all the way through: the charge appears, the record is created, the receipt arrives in an inbox that is not yours. Then do it again with a card that declines and confirm the app says something sensible.
Check the confirmation email did not land in spam — for a new sending domain it very often does, and that is a configuration problem with a known fix rather than something to discover from a customer. Have one person reachable by phone for the thing you did not anticipate, because there is always one.
03
What people skip and later regret
Email deliverability, until the receipts stop arriving. A real 404 and error page, so a mistyped URL does not show a stack trace with your file paths in it. An uptime check, so you are not told your site is down by a customer. And a written note of who to call when something breaks, which sounds unnecessary right up until 6pm on a Friday.
$50 FLAT — FINDINGS + A FIXED QUOTE IN 48 HOURS
$50
Flat initial review
48h
Written findings + fixed quote
START THE REVIEW
- Can I work through this list myself?
- Most of it, yes — that is why it is written out. The review exists for the items that need someone who can read the code to confirm.
- How do I check my keys are not in the browser bundle?
- Open the live site, press F12 to open developer tools, and search across every loaded file (Cmd or Ctrl + Shift + F) for the first few characters of your key. If it appears, treat it as public: rotate it and move it server-side.
- How far before launch should I book a review?
- A week is comfortable. Findings return within 48 hours, and that leaves room to fix what comes back without moving your date.
- Do I get this as a document I can keep?
- Yes. The findings arrive as a written checklist against your specific project, with each item marked done, missing or not applicable.