pre-deploy-checklist

Run the `check-alerts` agent to check for error monitoring and alerting integration. Report the results directly — do not run any other checks.

Run the `check-auth-config` agent to review Supabase auth configuration for security best practices. Report the results directly — do not run any other checks.

Run the `check-cors` agent to scan for CORS misconfigurations across the codebase. Report the results directly — do not run any other checks.

Run the `check-dependencies` agent to audit npm dependencies for known vulnerabilities and outdated core packages. Report the results directly — do not run any other checks.

Run the `check-env` agent to check environment variable security — git tracking, .gitignore, .env.example, and hardcoded secrets. Report the results directly — do not run any other checks.

Run the `check-error-handling` agent to audit error boundaries, loading states, and Supabase error handling. Report the results directly — do not run any other checks.

Run the `check-indexes` agent to audit database index coverage against actual query patterns. Report the results directly — do not run any other checks.

Run the `check-logging` agent to audit logging standards and check for sensitive data or PII in logs. Report the results directly — do not run any other checks.

Run the `check-rate-limiting` agent to check API routes for rate limiting coverage. Report the results directly — do not run any other checks.

Run the `check-rls` agent to audit Row-Level Security policies on all Supabase tables. Report the results directly — do not run any other checks.

Run the `check-rollback` agent to verify rollback readiness for Vercel deployments and Supabase migrations. Report the results directly — do not run any other checks.

Run the `check-validation` agent to scan API routes and server actions for missing input validation. Report the results directly — do not run any other checks.

Run the `fix-codebase` agent. Since this is a standalone run (not from /pre-deploy), the agent will do its own quick assessment of the codebase first (validation, CORS, error handling, logging, rate limiting), then generate fixes for what it finds. All fixes require user approval before applying.

Run the `fix-database` agent. Since this is a standalone run (not from /pre-deploy), the agent will do its own quick assessment of database security (RLS, indexes, auth config) first, then generate fixes for what it finds. All fixes require user approval before applying.

Run the `fix-infra` agent. Since this is a standalone run (not from /pre-deploy), the agent will do its own quick assessment of infrastructure readiness first (auth config, monitoring, rollback, env docs), then generate fixes for what it finds. All fixes require user approval before applying.

Run the pre-deployment checklist by spawning subagents for each check. This keeps the main context clean.

Run the `security-reviewer` agent to do a comprehensive security review covering OWASP top risks for Supabase + Vercel apps. This is a deep review — it covers access control, input validation, secrets, network security, and auth config. Report the results directly.

Check for error monitoring and alerting integration

Review Supabase auth configuration for security best practices

Scan for CORS misconfigurations across the codebase

Audit npm dependencies for known vulnerabilities and outdated core packages

Check environment variable security — git tracking, .gitignore, .env.example, hardcoded secrets

Audit error boundaries, loading states, and Supabase error handling

Audit database index coverage against actual query patterns

Audit logging standards and check for sensitive data in logs

Check API routes for rate limiting coverage

Audit Row-Level Security policies on all Supabase tables

Verify rollback readiness for Vercel deployments and Supabase migrations

Scan API routes and server actions for missing input validation

Apply codebase fixes — Zod validation, CORS config, error boundaries, logging, rate limiting

Generate and apply database fixes — RLS policies, indexes, auth config updates

Apply infrastructure fixes — auth config, monitoring setup, migration templates, env documentation

Run a comprehensive security review before deployment — covers OWASP top risks for Supabase + Vercel apps

Enforce error handling patterns in React components and API routes

Enforce structured logging standards in server-side code

Enforce security patterns across the codebase

Enforce input validation patterns when writing API routes or server actions

5 hooks across 2 events