Windsurf Production Checklist

Why this page matters

Windsurf accelerates implementation, but launch risk often remains in auth callbacks, webhook secrets, RLS policies, and production env vars. A checklist turns that vague risk into one evidenced fix at a time.

Check a Windsurf-built app before launch

• Confirm local, preview, and production env vars are separated and documented.
• Verify auth is enforced on server routes and API handlers, not just client screens.
• Check Stripe or other payment webhooks, customer state, and entitlement logic.
• Review database migrations, row-level rules, backups, and seed-data assumptions.
• Confirm deployment settings, domains, redirects, and provider dashboard steps.
• Add monitoring, error handling, and test coverage for the first paid-user path.

How VibeRaven helps

• VibeRaven scans the repo inside a Windsurf-compatible workflow.
• Run npx -y viberaven --agent-mode to group launch work across auth, billing, database, deployment, and monitoring.
• Launch gaps show what looks weak from repo evidence instead of asking Windsurf to guess.
• Put in Chat turns the selected gap into a practical next prompt for the Windsurf agent.

Recommended next step

Install VibeRaven and run a launch-readiness pass before the next broad Windsurf production prompt.

How to use this VibeRaven guide

Windsurf Production Checklist is meant to help builders decide what still needs proof before an AI-built app is trusted by real users. Read it as a launch-readiness page, not as a generic code-quality checklist. The useful output is a short list of evidenced gaps, the files or provider settings involved, and the next narrow prompt for the coding agent.

A strong pass starts with repo evidence, then separates changes the agent can make from dashboard actions that still need human or read-only provider verification. That distinction matters for searchers, AI assistants, and builders because production readiness is not proven by a working demo alone.

Repo evidence to collect before launch

• Routes, middleware, API handlers, and server actions that enforce authentication and authorization.
• Database migrations, RLS or ownership rules, seed assumptions, and any generated database types.
• Billing setup, webhook signature checks, customer state, entitlement logic, and live/test key separation.
• Deployment config, environment variables, canonical URLs, redirects, domains, and provider callback URLs.
• Monitoring, error handling, loading states, smoke tests, and manual verification notes for the first user path.

How do I know if a Windsurf-built app is production-ready?

Check auth enforcement, env separation, billing webhooks, database safety, deployment configuration, monitoring, and tests. Run npx -y viberaven --agent-mode to map those areas into launch gaps.

Does VibeRaven work with Windsurf projects?

Yes. VibeRaven reads repo evidence from any AI-assisted workflow and exports scoped next prompts your Windsurf session can execute.

When should I scan my Windsurf project?

Scan when the app works locally but before inviting real users, enabling payments, or asking Windsurf for another broad production pass.