You built in a Replit workspace and you are ready to publish it.
Unlock the rest of the checks
Two checks in each section are open, including why they matter, how to check them, and the prompt. Every other check keeps its title on the page. The reason, the steps and the prompt for those checks are omitted until you pay. One payment of £10 opens every stack. Access does not expire.
Or pay £15 once for the same access and the AI-Ready Pack. That price is the checklist price plus the pack price. The pack does not change your ranking.
Card details go to Stripe, not to this form. After payment, this browser gets a cookie. Restore access sends a one-hour link if you need another device. Error fixes stay free.
0 of 22 done
Ticks are saved in this browser only.
Security
Critical
Replit Secrets stay out of the files you share. A key written into a script is one export or screenshot away from leaking. Deployment secrets are also separate from development secrets, so production can be empty even when the editor works.
You are working in this repository. Do not add features.
Goal: secrets are read from environment variables, and the README lists the names I must add in Replit Secrets for both development and the published app.
Steps:
1. Search the code for hard-coded keys and passwords.
2. Replace them with process.env or the language equivalent.
3. Do not print current secret values.
4. Add a checklist of variable names, and note that published apps have a separate secret set.
5. Tell me if any key was sitting in a file, so I can rotate it.
Critical
A Replit database URL inside browser code, or a Postgres port left open, lets other people connect. The database should be reached by the server process only, with access checks for each user.
You are working in this repository. Do not add features.
Goal: the database connection string is server-only, and each route checks the signed-in user before returning private rows.
Steps:
1. Find the database client. If any frontend file imports it, move those calls behind a server route.
2. Add an auth check on routes that return user data.
3. Do not log the connection string.
4. Describe how I can confirm a signed-out request fails.
High
The reason, the checks and the prompt for this item are paid.
It is easy to put a live Stripe secret into the development workspace and take a real card by accident. Use test keys until the published app, the webhook, and the amount are all checked. Then set live keys only on the published app.
You are working in this repository. Do not add features.
Goal: Stripe keys come from environment variables, checkout amounts are chosen on the server, and webhooks verify the Stripe-Signature header.
Steps:
1. Remove any hard-coded Stripe keys.
2. Create the Checkout Session on the server using a price id.
3. Verify webhook signatures with the endpoint secret before updating an order.
4. Document STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET and the publishable key name.
5. Do not print secret values. Tell me to keep test keys in place until I say otherwise.
Deploy
High
A Replit workspace can sleep, and a server that listens on localhost will not answer the public URL. Replit's own notes say the process must listen on 0.0.0.0, and that 'Application failed to respond' means it is not on the port they expect.
You are working in this repository. Do not add features.
Goal: the web server listens on 0.0.0.0 and on process.env.PORT so a Replit deployment can reach it.
Steps:
1. Find the listen() or equivalent call.
2. Bind the host to 0.0.0.0 and the port to the PORT environment variable, with a local default for development.
3. Do not bind only to 127.0.0.1.
4. If there is a .replit ports block, explain what localPort should match.
5. Do not deploy it yourself.
SEO and AI visibility
The AI-Ready Pack is a paid download of llms.txt templates, robots rules, schema and a short guide. Publishing those files does not, by itself, change your ranking.
Medium
The address replit.app does not explain the product. The title and description are what a search result or a chat preview can quote. Set them before you announce the URL.
You are working in this repository. Do not add features.
Goal: the public HTML has a specific title and meta description.
Steps:
1. Find the base HTML template or the framework head.
2. Set the title and description from the product's real purpose. Do not leave 'Replit' or 'My App' if that is still the title.
3. Do not invent testimonials or download counts.
4. Show me the tags.
A SoftwareApplication block in JSON-LD gives search engines the product name, URL and description in a structured form. It does not replace a clear page. The type is published by schema.org.
You are working in this repository. Do not add features.
Goal: The public homepage includes valid SoftwareApplication JSON-LD.
Work in the Replit project, in the files the published site serves.
Steps:
1. Add one application/ld+json script with @context https://schema.org and @type SoftwareApplication.
2. Set name, url and description from the real product. Do not add aggregateRating, review, or offers unless I have given you those facts.
3. Keep the JSON valid.
4. Do not invent traffic numbers, reviews, or testimonials.
5. Show me the files you changed.
A published Replit app that creates accounts is collecting personal data. You need a page that says what you store and how someone can reach you. The workspace owner name is not a privacy policy.
You are working in this repository. Do not add features.
Goal: add a /privacy page and a footer link. Describe only the data the app stores.
Steps:
1. Inspect forms, auth and the database.
2. Write plain-language sections for what is collected, why, and how to request deletion.
3. Use [CONTACT EMAIL] and [REGISTERED ADDRESS] as placeholders.
4. Do not invent a company number.
5. List the placeholders for me.
Monitoring
Medium
The editor console is not the published app. Replit keeps deployment logs for the running process. Look at them after publish, and again after the first users, or you will miss crashes that happen when the workspace is closed.
You are working in this repository. Do not add features.
Goal: startup and request failures log a single JSON line, and secrets are not included.
Steps:
1. Log when the server starts, including the port, not the secrets.
2. On an unhandled error, log the message and stack on the server, and return a short public error.
3. Remove any console.log of env objects.
4. Tell me where those lines will appear once the app is published.