saas-launch-checklist

# SaaS Launch Checklist A structured checklist for shipping a SaaS product to production with confidence. Every item exists because someone skipped it and regretted it. ## Pre-Launch Checklist (28 Items) ### Infrastructure (5 items) - [ ] **SSL/TLS** -- Certificate installed, auto-renewal configured (Let's Encrypt / ACM), HSTS header present - [ ] **CDN** -- Static assets served through CDN, cache-control headers set, origin shielding enabled - [ ] **Backup** -- Database backup scheduled (daily minimum), tested restore procedure, off-site copy - [ ] **Monitoring** -- Health check endpoint returns 200 when healthy and 503 when degraded, uptime monitor pings every 60s - [ ] **Alerting** -- PagerDuty/Opsgenie configured, on-call rotation set, escalation policy defined (5 min ack SLA) ### Security (5 items) - [ ] **Penetration test** -- Run OWASP ZAP or equivalent against staging, fix all HIGH/CRITICAL findings - [ ] **Dependency audit** -- `npm audit` / `pip-audit` / `trivy` shows zero critical CVEs - [ ] **Secret rotation** -- All production secrets differ from staging, rotation schedule documented - [ ] **Rate limiting** -- API endpoints rate-limited (e.g., 100 req/min per user), auth endpoints stricter (10 req/min) - [ ] **Headers** -- CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy all configured ### Legal (4 items) - [ ] **Terms of Service** -- Reviewed by legal counsel, published at `/terms`, acceptance recorded at signup - [ ] **Privacy Policy** -- G...