deployment-readiness-check

Audit key settings including DEBUG=False, a SECRET_KEY loaded from environment variables, explicit ALLOWED_HOSTS, CORS_ORIGIN_ALLOW_ALL=False, and SECURE_SSL_REDIRECT, SESSION_COOKIE_SECURE, and CSRF_COOKIE_SECURE all set to True. This Skill greps settings.py and runs a Django shell check to verify each value.

Use grep patterns targeting assignments like SECRET_KEY, STRIPE_SECRET, TWILIO_AUTH_TOKEN, and SENDGRID_KEY with literal string values across settings and app directories. Also verify .env files are gitignored and not tracked by git, and confirm no Stripe secret keys appear in frontend NEXT_PUBLIC_ variables.

Yes, database and environment checks run inside the container using docker exec with the backend container. On Windows Git Bash, the MSYS_NO_PATHCONV=1 prefix prevents path mangling. For bare-metal deployments, the same commands run in the local virtualenv instead.

Next.js production builds fail when required environment variables like NEXT_APP_BACKEND_BASE_URL are missing, since they are compile-time constants. Ensure the variable points to the production backend URL rather than localhost before running yarn build.

Blocking findings include DEBUG=True, a hardcoded or short SECRET_KEY, ALLOWED_HOSTS containing "*", unapplied database migrations, critical dependency vulnerabilities from pip-audit or yarn audit, and missing production credentials for Stripe, Twilio, SendGrid, or Azure Search.