# Architecture & security checklist

Use before a launch, fundraise, or scale-up.

## Architecture
- [ ] Clear service / module boundaries and ownership
- [ ] Data flow documented (reads, writes, events)
- [ ] Failure modes identified for critical paths
- [ ] Environments (dev / staging / prod) actually match

## Security
- [ ] Authn/authz model reviewed for privilege creep
- [ ] Secrets not in source; rotation path exists
- [ ] Dependency and image scanning in CI
- [ ] Sensitive data classified and access-logged

## Delivery & quality
- [ ] CI runs tests and lint on every PR
- [ ] Deployments are repeatable (not tribal knowledge)
- [ ] Rollback path known and practiced
- [ ] Observability: logs, metrics, alerts on user-facing failures

## Reliability
- [ ] Backups tested, not just configured
- [ ] Rate limits / abuse controls where public
- [ ] On-call or owner for production incidents
- [ ] Performance budgets for critical user journeys

---
From [NextEra Security](https://nexterasecurity.com/playbooks/) — free to copy.