> free_download // deploy checklist v1

Localhost → Live.

The vibe-coder deploy checklist. 25 boxes between "works on my machine" and a URL you can actually send people. Works for apps built with Lovable, Bolt, Replit, Cursor, Claude Code, v0 and friends.

Free, no email required. Ticks save in this browser only (nothing leaves your device). Print it or save as PDF if you're old-school.

VibeShip Daily · vibeshipdaily.com/checklist · free to print and share

shipmaster@vibeship:~$ preflight --checklist

PREFLIGHT STATUS

0 / 25 checks passed
not shipped yet. no pressure. (some pressure.)

// the checklist

Tick every box, then hit deploy

01Get your code somewhere real

Project is in a GitHub repo you own (export or sync it out of the AI builder).
.env and .env.local are in .gitignore. GitHub docs
You know your stack: open package.json (or the files at the project root) and note the framework, database and auth provider.

02Secrets

No API keys hardcoded in frontend code. Search the repo for sk_, key, secret, token.
Anything prefixed NEXT_PUBLIC_ / VITE_ ends up visible in the browser. Never put a secret there. Next.js docs · Vite docs
Rotate any key that was ever committed or shown in the browser. Deleting the file doesn't delete it from git history. Rotate first, clean history second. GitHub docs

03Pick a host that matches your app

Static or frontend-only → Vercel / Netlify (connect the repo).
Has a server or API → a host that runs servers (e.g. Railway, Render, Fly).
App reads the port from process.env.PORT and binds to 0.0.0.0, not localhost. Railway guide

04Environment variables

Every process.env.X in the code is set in the host dashboard.
Redeploy after changing env vars. On most hosts, changes only apply to new deploys, and frontend vars get baked in at build time. Vercel docs

05Database

Not using SQLite or local files on a host with an ephemeral filesystem. Use managed Postgres / Supabase / Firebase.
Supabase: Row Level Security is on and policies are tested. Firebase: security rules aren't "allow all." Supabase RLS · Firebase rules
Test it: sign up as user B and confirm you can't see user A's data.

06Auth

OAuth redirect URLs (Google, GitHub and others) include your production domain.
Sign-in works in an incognito window.

07Payments (if any)

Stripe webhook points at the production URL and verifies signatures. Stripe docs
Test purchase actually unlocks the account (test mode first). Stripe testing

08Domain

Domain added in the host dashboard; DNS records set at your registrar.
DNS can take a while to propagate. Check with dig yourdomain.com +short before panicking.
HTTPS works and HTTP redirects to HTTPS.

09Before you share the link

Hard refresh plus mobile check.
Error tracking installed (e.g. Sentry). Sentry docs
Free uptime monitor pointed at your site.
You know how to roll back to the previous deploy.