ship-check

name	ship-check
description	Pre-release checklist. Verify SEO, OG images, payment flows, error handling, Analytics, favicon, performance, and security before deploying to production. Use before deploying any app or SaaS to production.
allowed-tools	["Read","Write","Edit","Grep","Glob","Bash","WebFetch","Agent"]

Ship Check — Pre-Release Verification

Run this checklist before deploying to production.

Process

1. Auto-detect the project's framework and configuration
2. Check each category below in order
3. If issues are found, propose fixes and apply with permission
4. Output a summary of all check results

---

1. SEO

• <title> tag on each page (in Next.js, metadata export)
• <meta name="description"> present
• robots.txt exists
• sitemap.xml exists (or generation is configured)
• Canonical URL is set
• Structured data (JSON-LD) present (recommended, not required)

2. OG Images & Social Sharing

• og:title, og:description, og:image are set
• og:image file exists (1200x630 recommended)
• Twitter Card (twitter:card, twitter:image) is set
• Favicon is set (/favicon.ico or link tag)
• apple-touch-icon present

3. Payment Flow (Stripe / Gumroad / crypto)

• Production API keys are in environment variables (not hardcoded)
• Webhook endpoint exists
• Success/failure handling for payments
• No test mode keys left in production
• Pricing and plan info is correct

4. Error Handling

• Global error handler exists (error.tsx / error boundary)
• 404 page exists
• API error responses are consistent
• User-facing error messages are localized

5. Analytics

• Google Analytics or equivalent tracking is installed
• Google Search Console verification file/meta tag exists
• Event tracking (conversions, signups, etc.) is configured

6. Performance

• Images are optimized (next/image, WebP, etc.)
• No unnecessary dependencies (bundle size)
• Loading states are implemented (Suspense / loading.tsx)

7. Security

• No environment variables hardcoded in source
• .env is in .gitignore
• CORS settings are appropriate
• Auth-required routes have middleware
• Basic SQL injection / XSS protections in place

8. Production Configuration

• Domain is configured
• HTTPS redirect is working
• Environment variables are set in production
• Build succeeds (npm run build with no errors)

---

Output Format

## Ship Check Results

### OK
- SEO: title, description, robots.txt
- OG: All items configured
- ...

### Needs Attention
- Payments: No webhook endpoint -> needs creation
- Analytics: Search Console not configured
- ...

### Proposed Fixes
1. ...
2. ...