Short answer: A product is ready for production when it can survive a stranger, a mistake and a busy day: nobody can read data they shouldn't, you can restore yesterday's data, you hear about errors before customers do, pages stay fast under load, your email arrives, and your legal pages and support channel exist. The list below is grouped by area and ordered by what hurts most if it's missing.
| Area | Ready when | vibeship checks |
|---|---|---|
| Security | No secrets in the browser or the code, database rules on, customers can't see each other's data, sign-in rate-limited, private files not public, libraries up to date | Checked |
| Code and repository | No keys in git history, dependencies without known critical holes, reviewed changes | Checked (with a subscription) |
| Legal pages and trust | Privacy policy, terms, contact, company details or Impressum | Checked |
| Data protection | Processor agreements, consent before tracking, a way to answer deletion requests | Partly checked |
| Speed | Pages load fast on a phone; the database has indexes for your common queries | Partly checked |
| Reliability | Deploys can be rolled back; one slow service doesn't take the app down | Partly checked |
| Backups | Automatic backups, kept off the main system, restored at least once as a test | Not checked yet |
| Monitoring | Error tracking, uptime alerts that reach a person, logs you can search | Not checked yet |
This is the list for the step from "people pay for it" to "we can grow it". Each area is marked with how much of it vibeship checks today, the same marks as on our home page.
Work through the security check before launch. A data leak is the one problem a young product may not recover from.
Turn on automatic backups (Supabase, Neon, RDS and most hosts offer point-in-time recovery on paid plans) and restore one into a scratch database. A backup you have never restored is a hope, not a backup.
Add error tracking to the front end and the server, an uptime check on your main pages and your API, and send both to a phone, not just an inbox.
Know how to roll back to the previous version in under five minutes, and keep database changes backward-compatible for one release so a rollback doesn't break.
Check your slowest pages on a phone, add indexes for the queries behind them, and set limits on anything expensive (AI calls, exports, uploads) per user.
Set up SPF, DKIM and DMARC so receipts and password resets reach the inbox. How.
Privacy policy, terms, contact details, and processor agreements. GDPR basics.
A support address that someone reads, and a status page or at least a known place where you post outages.
You can do all of the above by hand. If you'd rather start with a list of what's wrong, the vibeship quick check runs from outside, the way a stranger sees your site. The quick check is free and needs no account. It shows your grade and how many problems sit in each area; what each problem is and how to fix it is in the full report.
An MVP proves people want it. Production-ready means it keeps working and keeps data safe when more people, more data and the occasional attacker arrive. Most of the gap is invisible from inside the app.
Anything that leaks data (open database rules, keys in the browser, customers seeing each other's data), then backups, then monitoring. Speed and polish come after.
No. They become relevant when larger customers ask for them. This checklist is the groundwork those audits build on.
Before launch, after every big change, and every quarter. Security and dependencies drift fastest.
Sources checked on 25 October 2026.