We're preparing to launch a video-based platform with payments and several other features, but we only have about a week left. The team has two backend developers and one frontend developer. I currently manage separate development and staging servers and am preparing production. The infrastructure is provisioned with Ansible, and deployments run through a self-hosted GitLab runner on a dedicated 32-core server. Much of the CI/CD configuration was generated with AI and then reviewed and adjusted by me. What should we validate before launch, which operational and security practices matter most, and what common mistakes should we avoid with such a short timeline?
3 Answers
Bring in an experienced engineer or security reviewer immediately. A week is not enough to discover every weakness through trial and error, so focus on a launch-readiness review: authentication and authorization, payment handling, secret management, backups and restoration, database migrations, logging, monitoring, rate limits, dependency vulnerabilities, and failure recovery. Have someone who did not write the deployment configuration review it before production.
Treat this as a risk-management exercise rather than a chance to perfect the platform. Lock down SSH and cloud or server access, use a secrets manager instead of files or pipeline variables where possible, enable TLS everywhere, apply least-privilege permissions, and separate production credentials from development credentials. Set up alerts for errors, disk usage, CPU, memory, failed deployments, payment failures, and unusual traffic. Confirm backups are automated, retained, encrypted, and restorable. Also define who responds when something breaks and how you will pause new signups or payments if necessary.
The operational plan is a good point. We need explicit owners for incidents and a way to disable risky parts of the service without taking everything offline.
Freeze the scope and launch the smallest useful version. Do not introduce major features, infrastructure changes, or untested deployment logic during the final week. Build and test immutable application artifacts, promote the exact same artifact from development to staging to production, and keep production changes auditable. Make sure you can roll back both the application and database changes, and rehearse the rollback before launch.
Documentation alone is not enough if the rollback or restore process has never been tested. Run a staging deployment and recovery exercise using realistic data and traffic assumptions.
That makes sense. I’m especially concerned about gaps I don’t know to look for, so an independent review is probably the highest-value step.