Production Hardening

Before launching a SaaSStinger Lite application, review security, reliability, and operational settings.

Production hardening ensures:

• User data is protected
• Permissions work correctly
• Configuration is secure
• Application behavior is predictable

Production Readiness Areas

Review:

Authentication

Firestore Security

Environment Variables

Permissions

Error Handling

Monitoring

Deployment

Authentication Review

Verify:

• Firebase Authentication providers are correctly configured
• Email verification behavior is intentional
• Password reset works
• Protected routes require authentication

Authentication Checklist

Confirm:

• Registration works
• Login works
• Logout works
• Password reset works
• Email verification works
• Unauthenticated users cannot access dashboard

Firestore Security Review

Firestore rules are a critical security boundary.

Review:

firestore.rules

Verify:

• Workspace isolation
• Role permissions
• Document ownership
• Protected operations

Workspace Isolation

Every workspace resource should verify:

User

+

Workspace Membership

+

Permission

A user should never access another workspace's data.

Role Permission Review

Review all roles:

OWNER

ADMIN

MEMBER

Confirm:

OWNER

Can perform:

• Workspace administration
• Ownership actions
• Administrative operations

ADMIN

Can perform:

• Team management
• Administrative actions

MEMBER

Can perform:

• Allowed workspace tasks

Cannot perform:

• Administrative actions

Environment Security

Production variables should be stored securely.

Required variables:

Client:

NEXT_PUBLIC_FIREBASE_API_KEY=
NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN=
NEXT_PUBLIC_FIREBASE_PROJECT_ID=
NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET=
NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID=
NEXT_PUBLIC_FIREBASE_APP_ID=

Server:

FIREBASE_PROJECT_ID=

FIREBASE_CLIENT_EMAIL=

FIREBASE_PRIVATE_KEY=

Never Commit Secrets

Do not commit:

.env.local

service-account.json

private keys

Verify:

.gitignore

contains sensitive files.

Admin SDK Protection

Firebase Admin SDK must only run server-side.

Correct:

Server Action

        ↓

Firebase Admin

        ↓

Firestore

Incorrect:

Browser

        ↓

Firebase Admin

Error Handling

Production applications should not expose internal errors.

Avoid displaying:

• Database errors
• Stack traces
• Internal paths
• Credentials

Logging Review

Review:

• Server logs
• Authentication events
• Audit logs

Do not store sensitive information unnecessarily.

Audit Logging

SaaSStinger Lite audit logs are designed for administrative visibility.

Review:

• Events being captured
• Actor information
• Workspace association
• Retention behavior

Notifications Review

Verify:

• Notification creation
• Read status behavior
• Workspace association

Performance Review

Before launch:

Check:

• Large data tables
• Slow queries
• Excessive client rendering
• Missing indexes

Firestore Indexes

Review:

firestore.indexes.json

Deploy required indexes before production traffic.

Build Verification

Run:

pnpm tsc --noEmit

Then:

pnpm lint

Then:

pnpm build

All should complete successfully.

Deployment Configuration

Verify:

• Production environment variables
• Firebase project selection
• Hosting configuration
• Domain configuration

Backup Strategy

Before launch:

Confirm:

• Firestore export strategy
• Recovery process
• Administrative access

Removing Development Data

Before production launch:

Remove:

• Test users
• Demo workspaces
• Emulator exports
• Development credentials

Final Production Checklist

Security

• Firestore rules reviewed
• Admin credentials secured
• Authentication tested
• Permissions verified

Application

• Build succeeds
• Environment variables configured
• Error handling reviewed
• Navigation tested

Data

• Indexes deployed
• Backup strategy defined
• Test data removed

Documentation

• User documentation updated
• Deployment notes updated
• Release checklist completed

Related Documentation

• Deployment
• Security
• RBAC Permissions
• Authentication
• Firestore Schema
• Release Checklist