The launch checklist AI tools skip

Secrets and environment exposure

Start with the simplest question: did anything secret slip into the browser? Check the client bundle for OpenAI keys, Stripe secrets, Supabase service roles, and anything else that should never leave the server. Public configuration is one thing; privileged tokens are another.

Then confirm the deploy itself is not exposing what should remain private. `.env` files, source maps, and debugging leftovers are still among the most avoidable ways to lose a calm launch.

CORS, headers, auth, and debug

Authenticated APIs should not answer the whole internet. If a route returns sensitive data, it deserves an explicit origin policy rather than a wildcard.

Headers matter because they close off entire classes of sloppy defaults. Check CSP, HSTS, frame protections, and referrer policy. They are not glamorous, but they do real work.

Authorization belongs on the server, not in the UI. Debug panels, verbose traces, and public source maps belong nowhere near a production release.

Dependencies and discoverability

Run a dependency review before you call the release finished. Scaffolding gets old quickly, and a quiet dependency problem is still a production problem.

Then look at the public surface. Give the site a real title and description. Make sure `robots.txt` and the sitemap make sense. Add clean entity copy and, if you care about AI visibility, an `llms.txt` file. A launch is not complete if the product is safe but impossible to understand or discover.