6.4Checklists & templates
The essentials in 30 seconds
- At kick-off: LTS checked, package.json + scripts, layers decided, database chosen, async/await everywhere.
- Before production: validated inputs, complete security, secrets in .env, green tests, logs and scaling.
- Rule: a checklist ticked every time beats a method known by heart — under rush, you execute.
Salim thread — the sheets at hand
After one year, both sheets below are on display at Salim's: the kick-off one next to the screen, the production one in his drawer with the contact's details. “What saved me,” he says in substance, “is not knowing the points, it is ticking them every time — especially in rush weeks.”
Adapt the wording to your context, keep the structure: it is what avoids omissions and incidents.
Two lists to keep at hand
One checklist when starting a Node project, one before going to production. They turn good habits into a verifiable routine.
When starting a Node project
- Node LTS installed and checked (node -v / npm -v); VS Code with ESLint/Prettier.
- npm init, package.json + scripts; .gitignore (node_modules, .env).
- Layered structure decided (routes / controllers / models / services).
- Database choice (MongoDB/Mongoose or SQL/Prisma) and validated schema.
- Async convention: async/await everywhere, never a blocking synchronous call on a server.
Before going to production
- Validated inputs (Zod/Joi) and centralised error handling in place.
- Security: hashed passwords (bcrypt), verified JWT, authorisation, Helmet, HTTPS.
- Secrets and configuration in environment variables (never in code or Git).
- Tests (Jest) green and CI/CD pipeline that tests before deploying.
- Logs and monitoring, separate environments (dev/staging/prod), scaling plan (clustering/PM2).
Ready-to-say script — validating a production release (30 s)
«Validated inputs and centralised errors? bcrypt, JWT, authorisation, Helmet, HTTPS? Secrets in .env out of Git? Green Jest tests and CI/CD? Logs, separate environments, scaling? If any no, we do not go to production.»
Copy-paste template — kick-off + production tracking (1 line per point)
// Tracking: set each line to OK before moving on
const suivi = [
"LTS + VS Code (ESLint/Prettier): OK / to revisit",
"package.json + scripts + .gitignore: OK / to revisit",
"Layers + database + validated schema: OK / to revisit",
"Async/await everywhere: OK / to revisit",
"Validation + errors + bcrypt + JWT + Helmet: OK / to revisit",
"Secrets in .env out of Git: OK / to revisit",
"Jest green + CI/CD: OK / to revisit",
"Logs + dev/staging/prod + clustering: OK / to revisit"
];
module.exports = suivi;VSE / small budget
Sheets on one page posted on the wall: the essentials (LTS, layers, validation, .env, tests) are enough.
SME Algeria
Fold local realities into the sheet: known contacts, peaks, travel, verified backups.
Remote / hybrid
Add a written-confirmation line to tracking: at a distance, a dated, validated production release avoids misunderstandings.
Intercultural
Spell out labels in writing: what seems obvious (who validates, which environment) is not obvious to everyone.
48h challenge — apply tomorrow
Take 1 real project, run the “at kick-off” checklist and tick where it stands. Note the contact on the production sheet.
- I ticked a checklist on a real project.
- I know how to pull out kick-off and pre-production at the right time.
- I did the 48h challenge or scheduled its date.
Salim is about to put his API into production. What must he tick first?
Tip: these checklists prevent most incidents — blocked server, unvalidated data, leaked secret, undetected regression, failed deployment.