Fast development makes it easy to ship a convincing interface before the edges are ready. A short pre-launch review catches the mistakes that are embarrassing at best and expensive at worst.
Check the public bundle
Search the client bundle and source maps for API keys, private endpoints, test credentials and environment values that should have stayed on the server. A key that is visible to a browser is not a secret, even if it is hard to spot.
Review the response headers
Start with a content security policy, strict transport security, content-type protection, a sensible referrer policy and a permissions policy that matches your product. Headers are not a substitute for authentication, but they reduce common browser-side mistakes.
Close the development doors
- Remove debug routes and test accounts.
- Make sure admin pages require real authentication.
- Turn off verbose errors and intentional test bypasses.
- Decide whether production source maps should be public.
- Confirm CORS allows only the origins you actually use.
Run these checks against the deployed URL. A local build can look perfect while a deployment setting exposes a different configuration.
Write the rollback plan
Security is also operational. Know how to revoke a leaked key, roll back a release, contact affected users and preserve evidence. A five-minute checklist is valuable when it creates a calmer response to an unexpected finding.