Transitioning from a browser-based AI sandbox like **Bolt.new** or **Replit** to a self-hosted production Next.js 15 app requires systematic hardening.
Here is the exact 10-point checklist used by SprintLabs AI engineers during client Rescue Sprints.
---
Phase 1: Security & Environment Isolation
- [ ] **Remove Hardcoded Secrets**: Audit all `.env` files and ensure no API tokens exist in Git history.
- [ ] **Configure CORS Headers**: Restrict API endpoints to your verified domain.
- [ ] **Enforce Rate Limiting**: Implement Redis-backed rate limiting on public auth endpoints using `@upstash/ratelimit`.
---
Phase 2: Database & Data Integrity
- [ ] **Database Migration Scripts**: Replace auto-generated sync scripts with proper Prisma or Drizzle schema migrations.
- [ ] **Automated Daily Backups**: Enable point-in-time recovery (PITR) on PostgreSQL.
---
Phase 3: Performance & Core Web Vitals
- [ ] **Image Optimization**: Replace raw `
![]()
` tags with Next.js `
`.
- [ ] **Bundle Compression**: Target LCP < 1.8s and INP < 200ms.
---
Ready for Production?
Book a strategy session with SprintLabs AI to have our senior engineers review your codebase.
