The Launch Checklist Your Scanner Can’t Run

Episode 11 is the whole lesson in four panels: the code was secure, and the site was still wide open. Here is the list of things that live outside the code, and outside what an assistant will think to mention. Run it before every launch.

The checklist

1. Accounts. Every user on production is one you created there, with a password set there.
2. Default names. No user is called admin, test, demo or the product name.
3. Secrets. Every API key, database password and token on production is different from development’s, and none of them are in git.
4. Debug off. Debug mode, verbose errors and sample data are disabled.
5. File changes off. The web server can’t install plugins or edit code from the admin screen.
6. Unused doors closed. XML-RPC, unused APIs and unused login methods are off.
7. Updates. The platform and every dependency are current as of today, not as of when the assistant first scaffolded the project.
8. Backups. A backup exists, you have restored it once, and it lives somewhere the site can’t delete.
9. Monitoring. Something will tell you when a file changes or a new admin appears, before a visitor does.
10. The paper trail. Where production’s data came from is written down, so the next person doesn’t have to guess.

Prompt to steal

We are about to go live. Go through this checklist and answer each item
with evidence (a command output, a config line, a file path), not a yes:
1. accounts  2. default names  3. secrets  4. debug  5. file changes
6. unused doors  7. updates  8. backups  9. monitoring  10. data origin
If you can't show evidence for an item, say so. Do not mark it done.

Want the full routine with commands? This week’s Hint of the Week walks through a launch-day security pass for an AI-built site.