release-readiness

Release Readiness

The purpose of a gate is to make a decision explicit rather than implicit. Shipping with known gaps is legitimate — shipping without knowing what they are is not.

Produce one of three verdicts, in writing:

GO              No blockers. Ship.
GO WITH RISK    Named, accepted, owned risks. Ship, with mitigations listed.
NO GO           Named blockers. Do not ship until these close.

Never soften a NO GO into "mostly ready". If a blocker is real, say so in the first line and name it.

---

The blockers — any one of these is NO GO

These are not judgement calls. Each one causes a breach, data loss, or a legal exposure that the launch cannot be undone from.

• A secret is in the repository or its git history. Rotate first, then purge.
• Any user can access another user's data. Test it: authenticate as A, request B's resource.
• No backups, or backups that have never been restored.
• Personal data is processed with no privacy policy, or a policy that omits a processor actually receiving data.
• No way to delete user data when the policy or the law says there is.
• Payments where amounts are computed or trusted from the client.
• A webhook that mutates state without verifying its signature.
• String-interpolated SQL on a route reachable by a user.
• Debug mode enabled, or stack traces returned to clients.
• No rollback path that anyone has ever executed.
• A migration with no tested reverse running against production data.
• A known critical vulnerability in a reachable dependency.

If any box is unticked, the verdict is NO GO and the report is short.

---

The gate

1 · Security

• Secret scan clean, including git history
• Object-level authorization tested — the cross-user test exists and passes
• Authentication: hashing, session invalidation, rate limits, no user enumeration
• Input validated by schema at every entry point, including webhooks and queue consumers
• Security headers set; CSP without unsafe-inline
• Dependency audit run, output read, high-severity issues resolved or accepted in writing
• Debug off; stack traces not returned; admin surfaces network-restricted
• Rate limiting on auth and all mutations
• Uploads: type verified by content, size capped, served from a separate origin