Home › Any stack › Prototype-to-production hardening AGENTS.md

Prototype-to-production hardening AGENTS.md

AGENTS.md checklist for turning a vibe-coded prototype into a production-ready app: security, data, tests, and ops.

AGENTS.mdAny stack

Copy AGENTS.md

How to use

Save this as AGENTS.md in your repository root, commit it, and your agent will pick it up automatically. Edit the commands to match your project.

Note: Review and test before use. Provided as is, without warranty. See Terms.

# AGENTS.md: Hardening a prototype for production

Work through these in order. Each item is a separate small PR; report which items are done.

## 1. Secrets and config
- Move hard-coded keys/URLs into env vars, add `.env.example`, validate env at startup. Check git history for leaked secrets and tell the user which ones to rotate.

## 2. Auth and access control
- Every server route/action requires auth unless intentionally public. Add ownership checks on every record read or write. Database rules (RLS/policies) enabled where the platform supports them.

## 3. Input and data
- Schema validation on all inputs. Parameterized queries. Real migrations instead of manual schema edits; backups configured.

## 4. Errors and logging
- Global error handling with user-friendly messages; structured server logs; an error tracker (Sentry or similar) wired up but without PII.

## 5. Tests
- Smoke e2e test for the main user journey, unit tests for business logic, and CI running lint, typecheck, tests, and build on every PR.

## 6. Performance and limits
- Pagination on lists, rate limits on auth and expensive endpoints, image optimization, timeouts on external calls.

## 7. Operations
- Separate dev/staging/prod environments and databases. Health check endpoint. Documented deploy and rollback steps.

## 8. Legal and UX basics
- Privacy policy/terms placeholders flagged for the user, accessible forms, loading and empty states.

Don't deploy or change production settings yourself; prepare the changes and list what the user must do.