# Launch Checklist

## Source-document requirements

- [x] Entire `.com` intended to sit behind Cloudflare Access.
- [x] Exact approved email model.
- [x] One-time PIN concept.
- [x] No shared password.
- [x] Private services catalogue.
- [x] Backend-generated Paystack transactions.
- [x] Server-side payment verification.
- [x] Paystack webhook signature validation.
- [x] Approval/status database.
- [x] Expiring invitation design.
- [x] Noindex/noarchive/nosnippet.
- [x] No public client documents.
- [x] Origin protection guidance.
- [x] Public webhook exception.

## Before production

- [ ] Replace placeholder service prices.
- [ ] Configure real client email records.
- [ ] Configure invitation email delivery.
- [ ] Finish admin CRUD screens.
- [ ] Configure Cloudflare Access.
- [ ] Confirm origin is not directly exposed.
- [ ] Configure Paystack webhook.
- [ ] Test test-mode transactions.
- [ ] Test duplicate webhook delivery.
- [ ] Test amount tampering.
- [ ] Test wrong-currency verification.
- [ ] Test revoked/expired client.
- [ ] Test document authorization.
- [ ] Enable backups.
- [ ] Review PHP/server error logs.
- [ ] Disable display_errors in production.
- [ ] Set correct filesystem permissions.
- [ ] Run HTTPS-only.
- [ ] Remove development/staging endpoints.
- [ ] Confirm robots/noindex headers.
- [ ] Perform an external security review before handling sensitive client documents.

## Error prevention

- Use PDO prepared statements.
- Validate every ID from the browser.
- Never trust frontend prices.
- Never expose secret API keys.
- Verify payment on the server.
- Verify webhook signatures.
- Make fulfilment idempotent.
- Store private files outside web root.
- Use CSRF tokens on state-changing browser requests.
- Regenerate session IDs after login.
- Keep audit logs.