Most developers spend months building features and then rush the launch, skipping steps that turn out to matter. This checklist covers the 20 things you should have in place before you tell anyone about your SaaS product.
Authentication & Access
1. Email + password auth with proper hashing. Passwords must be hashed with bcrypt (cost factor ≥ 12) or Argon2. Never store plain text. Never use MD5 or SHA-1 for passwords.
2. Email verification. Require users to verify their email before they can access paid features. This reduces fraud, improves deliverability when you send emails, and gives you a confirmed contact channel.
3. Password reset flow. Test it end-to-end. The reset link should expire in 1 hour. After a reset, all existing sessions should be invalidated.
4. Rate limiting on auth endpoints. Without rate limiting, your login and register endpoints are targets for credential stuffing and brute force attacks. Apply at minimum 5 requests/minute per IP on auth routes.
Payments
5. A working payment flow in production. Not sandbox — actual production. Test with a real card. Confirm the webhook fires and your database updates. This is the single most common thing that breaks on launch day.
6. Subscription management. Users need to be able to upgrade, downgrade, and cancel without emailing you. Automate it.
7. Billing receipt emails. Legal requirement in most jurisdictions. Most payment processors (iyzico, Stripe) send these automatically — make sure they're configured.
Error Handling & Monitoring
8. Error monitoring. Sentry (free tier) or Highlight.io will capture unhandled exceptions and send you alerts. Without it, you'll find out about crashes when users email you — or when they don't.
9. Structured logging on the backend. Use a logger (Pino, Winston) instead of console.log. In production, logs should be searchable. Railway and Vercel both surface structured logs in their dashboards.
10. Graceful error pages. A 500 page that says "Internal Server Error" looks unfinished. A 404 that helps users navigate back looks professional. Both are worth 20 minutes.
Security
11. HTTPS everywhere. Every endpoint, including API callbacks and webhooks. Most hosting platforms (Railway, Vercel) handle this automatically — confirm it's enabled.
12. CORS configured correctly. Your API should only accept requests from your frontend domain in production. A wildcard * CORS policy is a security risk.
13. Secrets in environment variables. No API keys, JWT secrets, or database passwords in your code or git history. Audit with git log -p if you're unsure.
14. Input validation. Validate and sanitize all user input at the API boundary. Use class-validator in NestJS, or Zod in a plain Express app. Never trust what comes from the client.
Legal & Trust
15. Privacy Policy. Required by GDPR if you have any EU users (and you will). Must explain what data you collect, how you use it, and how users can request deletion.
16. Terms of Service. Protects you legally. At minimum, cover acceptable use, subscription terms, limitation of liability, and governing law.
17. Cookie consent (if applicable). If you use analytics cookies or tracking, EU law requires consent. If you only use essential/session cookies, a simple notice in your privacy policy is sufficient.
SEO & Marketing Basics
18. A sitemap.xml submitted to Google Search Console. Without it, Google may still find your pages, but it'll take longer. Submit it manually and check the coverage report after 48 hours.
19. Open Graph meta tags. When someone shares your link on Twitter, LinkedIn, or Slack, the preview should show your product name, description, and a good-looking image. Without OG tags, the preview is bare text.
20. A real email address for your domain. hello@yourproduct.com or support@yourproduct.com, not a Gmail. Domain-verified email improves deliverability and looks professional. Set up SPF, DKIM, and DMARC records.
Automate the Boilerplate
Items 1–4 (auth), 8–14 (error handling and security), and the deployment configuration can be generated automatically. PromptForge produces NestJS applications with authentication, rate limiting, input validation, Dockerfile, and CI/CD configuration built in — so you can focus on items 5–7 (payments) and 15–20 (legal and marketing), which genuinely require your attention.
Generate your backend for free and check 14 items off this list before you write a single line of business logic.