Checklists / Cursor or Claude Code, Next.js and Vercel
Cursor or Claude Code, Next.js and Vercel
An agent in Cursor or Claude Code wrote a Next.js app, and Vercel hosts it.
Unlock the rest of the checks
Two checks in each section are open, including why they matter, how to check them, and the prompt. Every other check keeps its title on the page. The reason, the steps and the prompt for those checks are omitted until you pay. One payment of £10 opens every stack. Access does not expire.
Or pay £15 once for the same access and the AI-Ready Pack. That price is the checklist price plus the pack price. The pack does not change your ranking.
Card details go to Stripe, not to this form. After payment, this browser gets a cookie. Restore access sends a one-hour link if you need another device. Error fixes stay free.
0 of 22 done
Ticks are saved in this browser only.
Security
Critical
Next.js inlines any NEXT_PUBLIC_ variable into the browser bundle. Cursor and Claude Code often put a server key behind that prefix because the preview then 'works'. Anyone can read it in the built files on Vercel.
You are working in this repository. Do not add features.
Goal: secrets are read only in server code, and no NEXT_PUBLIC_ variable holds a secret.
Steps:
1. Search for NEXT_PUBLIC_ and for key material.
2. Move secret reads into server components, route handlers or server actions. Rename the env vars so they do not start with NEXT_PUBLIC_.
3. If a real secret was committed or shipped, tell me to rotate it. Do not print it.
4. List the env var names Vercel needs, split into public and server-only.
5. Do not change product behaviour except where the client was calling a secret API directly. Move that call to a route handler.
High
A server action is a public POST, even if the button sits on a signed-in page. Agents often check the user in the layout and then trust the action. The action itself has to load the session and the ownership of the row.
You are working in this repository. Do not add features.
Goal: every server action and route handler that mutates data checks the session and the row owner inside that function.
Steps:
1. Find "use server" functions and POST handlers.
2. Load the session inside each one. If it is missing, return an error or 401.
3. Do not take a user id from form data and trust it. Use the id from the session.
4. Leave the UI checks in place, but do not rely on them.
5. Explain one signed-out request that should fail.
Payments
Critical
Marking an order paid because a request arrived is not enough. Anyone can POST fake JSON to that route. Stripe signs the raw body, and the signature only matches if you use the exact bytes and the endpoint's own secret.
You are working in this repository. Do not add features.
Goal: the Stripe webhook verifies the signature on the raw request body before it updates any order.
Steps:
1. Find the webhook route.
2. Read the raw body. In the App Router, that means the request text before any JSON parse.
3. Call stripe.webhooks.constructEvent with the body, the stripe-signature header, and STRIPE_WEBHOOK_SECRET.
4. Only after that succeeds, update the order for the event type you care about.
5. Do not print the webhook secret. Tell me to use the Dashboard signing secret in production, not the CLI secret.
Deploy
High
A .env.local file is not uploaded with the deployment. The preview can work on your machine and fail on Vercel because the URL, anon key or database string is missing. Production and preview can also point at different Supabase projects on purpose.
You are working in this repository. Do not add features.
Goal: the app fails with a clear message when a required server variable is missing, and the README lists every variable name.
Steps:
1. Find every process.env read.
2. Group them into server-only and NEXT_PUBLIC_.
3. At the server boundary, throw an error that names the missing variable and does not print its value.
4. Update the README with the names and which Vercel environment needs them.
5. Do not create the Vercel project.
High
next dev forgives errors that next build refuses. The usual ones are a missing module, a client hook in a server component, and a page that reads cookies while it is being rendered statically. If the Vercel build is red, there is no production app.
You are working in this repository. Do not add features.
Goal: the production build completes.
Steps:
1. Run the project build and read the first error.
2. If a module is missing, add the dependency that the import needs, or remove the unused import. Do not add a pile of unrelated packages.
3. If a client hook is used in a server component, add "use client" only on the component that needs it, or move the hook out.
4. If Next.js reports dynamic server usage because of cookies or headers, read them in the request path and await the call, rather than inside setTimeout.
5. Tell me the command you ran and the result. Do not disable type checks to hide the error.
SEO and AI visibility
The AI-Ready Pack is a paid download of llms.txt templates, robots rules, schema and a short guide. Publishing those files does not, by itself, change your ranking.
Medium
Next.js does not know your product name. Without metadata, a sitemap and a robots file, search engines and chat crawlers have less to quote, and they may index pages you meant to keep private.
You are working in this repository. Do not add features.
Goal: public pages export a title and description, /sitemap.xml lists public routes, and /robots.txt allows crawling and links the sitemap.
Steps:
1. Add metadata on the public routes. Do not invent ratings or user counts.
2. Add a sitemap that includes only public URLs, using the production site URL from an environment variable.
3. Add robots.txt that allows crawlers, including common AI crawlers, and points at the sitemap. Disallow signed-in paths such as /app or /dashboard if those exist.
4. Show me the files you added.
A SoftwareApplication block in JSON-LD gives search engines the product name, URL and description in a structured form. It does not replace a clear page. The type is published by schema.org.
You are working in this repository. Do not add features.
Goal: The public homepage includes valid SoftwareApplication JSON-LD.
Work in the Next.js app, in the root layout for metadata and in public/ for text files.
Steps:
1. Add one application/ld+json script with @context https://schema.org and @type SoftwareApplication.
2. Set name, url and description from the real product. Do not add aggregateRating, review, or offers unless I have given you those facts.
3. Keep the JSON valid.
4. Do not invent traffic numbers, reviews, or testimonials.
5. Show me the files you changed.
Auth, analytics and payments all collect data. A Next.js app you are about to share needs a privacy page that matches the real collectors, plus a contact address. Have the template reviewed before you treat it as legal advice.
You are working in this repository. Do not add features.
Goal: add /privacy based on the data this app actually stores, and link it from the footer.
Steps:
1. List collectors you can see in the code: accounts, Stripe customer ids, uploaded files, analytics scripts.
2. Write the page in plain language with placeholders [TRADING NAME], [REGISTERED ADDRESS] and [CONTACT EMAIL].
3. Do not claim ISO certificates, company numbers, or a DPO you cannot see.
4. Add the footer link.
5. Tell me what a solicitor or the owner still needs to fill in.
Monitoring
Medium
Vercel keeps function logs, but only if you look at them, and client errors never appear there unless you send them. A hydration mismatch or a failed server action will otherwise show up as a user saying the button did nothing.
You are working in this repository. Do not add features.
Goal: server errors are logged with console.error as JSON, and the UI shows a recoverable message.
Steps:
1. Add an error.tsx for the public segment so a render error is not a blank page.
2. In route handlers, log { path, message } on failure. Do not log headers or body.
3. Keep the existing Vercel runtime. Do not add a new paid service unless one is already configured.
4. Tell me how to open the logs for the production deployment.