Free sample · not for sale
List the data before you touch a setting. Most public failures are a table nobody wrote down. One full check is below the blanks, so you can see what a written “done” looks like.
Do this for production, not the demo on your laptop. One row per table, collection, or storage bucket. If you are unsure who should read a row, the row is not done. Write “not decided” and decide before you call the app live.
Fictional app, “Field Notes.” A person signs in and keeps notes. This is an illustration, not your app, and not evidence that any real product passed.
| Name | What is stored | Who may read | Who may write | Public on purpose? |
|---|---|---|---|---|
| profiles | Display name, account id | The person themselves | The person, for their display name only | No |
| notes | Private note body | The author | The author | No |
| published | Notes the author marked public | Anyone | The author | Yes, body and title only |
| uploads | Images attached to notes | The author, unless the note is public | The author | No, except images on public notes |
Copy this into a doc you control, or print it. Add rows until a stranger could see the shape of the app. Do not put passwords, keys, or connection strings in the matrix. Names of tables are enough.
| Name | What is stored | Who may read | Who may write | Public on purpose? |
|---|---|---|---|---|
| — | — | — | — | — |
| — | — | — | — | — |
| — | — | — | — | — |
| — | — | — | — | — |
| — | — | — | — | — |
| — | — | — | — | — |
App name ______________ Production URL ______________ Date ______________
This definition is free. The worksheet it was drafted for is not for sale, and that file is not on this site.
Done: the provider’s dashboard shows the production URL, not localhost and not a personal test inbox you will abandon. You accepted one test event the provider’s dashboard sent, and you refused one request signed with the wrong secret. The signing secret is in a server secret store, not in the repository. If the app has no webhook, write “no webhook” and mark it Done.
Mark ______ Provider and URL path (no secrets) ______________________________________
Do not write the signing secret on this line. The path is enough, for example “Stripe, /api/stripe/webhook”.
A free note you copy into a doc you control. This server does not read it. Nothing on this page is for sale.
The check that runs here is separate. Go-Live Check reads response headers you paste and returns findings. It does not score this matrix.