The Senior Dev Checklist

Congratulations

You've covered everything a senior developer needs to know about running software in production. This capstone is your complete launch checklist — run through it before every production deployment.

Infrastructure

• ☐ Domain proxied through Cloudflare (orange cloud)
• ☐ Cloudflare SSL: Full (Strict)
• ☐ HSTS enabled, Minimum TLS 1.2
• ☐ Nginx config passes nginx -t
• ☐ Let's Encrypt cert auto-renewal tested with --dry-run
• ☐ Firewall: only ports 22 (restricted IPs), 80, 443 open
• ☐ SSH root login disabled, non-root deploy user
• ☐ EC2 Elastic IP attached; Route 53 A records correct
• ☐ RDS in private subnet; SG allows only EC2 SG on 5432

Application

• ☐ All secrets in AWS Secrets Manager or env vars — never in code
• ☐ .env in .gitignore — verify with git status
• ☐ Docker image tagged with git SHA, not latest
• ☐ .dockerignore excludes .env, node_modules, .git
• ☐ Container runs as non-root user
• ☐ /health endpoint checks DB + Redis
• ☐ NODE_ENV=production set
• ☐ npm audit: no critical vulnerabilities
• ☐ CORS whitelist is tight — no * on authenticated endpoints

CI/CD

• ☐ CI runs on every PR: lint → types → tests
• ☐ Deploy gates on CI passing (needs: test)
• ☐ Production environment requires human approval
• ☐ Secrets stored in GitHub Secrets
• ☐ Previous 10 image versions kept for rollback

Observability

• ☐ Sentry installed, source maps uploaded
• ☐ Sentry alert: new error type → Slack
• ☐ Uptime monitor on /health
• ☐ SSL expiry monitoring (30-day alert)
• ☐ Structured JSON logging with pino
• ☐ Log rotation: max 10MB, 3 files

SEO & Analytics

• ☐ GA4 installed, key events tracked + marked as conversions
• ☐ Search Console verified, sitemap submitted
• ☐ robots.txt correct
• ☐ Canonical URLs on all pages
• ☐ JSON-LD structured data validated
• ☐ Open Graph tags for social sharing
• ☐ Core Web Vitals: LCP <2.5s, CLS <0.1, INP <200ms

Security & Reliability

• ☐ RDS automated backups: 7+ day retention
• ☐ Pre-migration RDS snapshot created
• ☐ Rollback runbook written and tested
• ☐ SPF + DKIM + DMARC configured for email domain
• ☐ AWS root MFA enabled; root never used
• ☐ Billing alerts at $10, $50, $100
• ☐ Dependabot enabled on GitHub repo
• ☐ GitHub secret scanning enabled

What's Next?

• Terraform / CDK — Infrastructure as Code for reproducible environments
• Kubernetes — container orchestration at scale
• OpenTelemetry — distributed tracing across microservices
• SRE — SLOs, error budgets, incident management frameworks
• Database internals — PgBouncer, read replicas, vacuum tuning