Short answer: before launch, walk your main path on the deployed site as a stranger, on a phone, in a private window. Then check forms and emails end to end, that no secret is in client code or git, that every user can see only their own data, that each page has a title, description and readable text for search and AI crawlers, that errors are logged, that analytics fire on the live domain, and that privacy and terms pages exist. Give Claude Code one item at a time, with the prompt below each, and review its changes.
1. The main path, as a stranger
- Open the live URL, not localhost, in a private window on your phone.
- Do the one thing a customer comes for: sign up, book, buy or contact you.
- Check that the first screen says what it is and shows the main button without scrolling.
Prompt for Claude Code: "Read the home page and the signup flow. List anything a first-time visitor on a phone could not understand or reach without scrolling, then propose the smallest changes."
2. Forms and emails
- Submit every form with real data and with mistakes: empty fields, a bad email, an existing account.
- Confirm the email arrives, from your domain, and its link opens the live site.
- Test password reset end to end.
Prompt: "List every form in the app, what happens on success and on each error, and which emails it sends. Flag any error message that does not tell the user what to do."
3. Secrets
- Search the repository and the built client bundle for API keys.
- Check that .env files are in .gitignore and never committed.
- Rotate any key that was ever in git history.
Prompt: "Search the repository and the production build output for API keys, tokens and service role keys. List each one, where it is used, and whether it reaches the browser."
4. Data access
If the app stores user data, sign in as one test user and try to load another user's record by changing an ID in the URL or request. With Supabase, check that row level security is on for every table with user data and that policies exist; Supabase's own checklist says to test user data isolation.
Prompt: "For every API route and database query, show how it checks that the signed-in user owns the data. List any route that does not."
5. SEO and AI search basics
- Each public page has its own title and meta description.
- The main content is in the HTML, not only rendered in the browser.
- robots.txt and a sitemap exist and point at your domain.
- Business or product details are in text, not images.
Our guide to SEO and AI search for a Claude Code site has the prompts.
6. Errors and analytics
- Add an error tracker, then load each main page and check the browser console is clean.
- Fire the events you care about (signup started, completed, paid) and check them on the live domain.
7. Legal and trust
- Privacy policy and terms, linked in the footer.
- A real contact method.
- A cookie banner if your analytics and your visitors' region require one.
Keep a CLAUDE.md for launch rules
Claude Code loads CLAUDE.md files at the start of each session. Put your launch rules there, for example "never put secrets in client code" and "every new page needs a title and meta description", so they apply to future changes too.
Where Persqo helps
You can work through this list with Claude Code alone. Persqo adds the outside view:
- Paste the Persqo prompt into Claude Code and your app gets a Persqo admin page at /admin/persqo. The prompt never contains your key; you put it in .env.local and your host's environment settings.
- An AI visitor tests the live app on desktop and mobile, with screenshots and a replay, and every finding comes with a fix prompt for Claude Code. Persqo fills in forms but does not send them unless you opt in. There is no verification step for you: Persqo confirms the site is yours in the background.
- One click: on a Next.js or Vite app, the Persqo fix runtime the prompt adds applies the home page title and description, business and FAQ schema and llms.txt, each with Undo. Next.js shows them within a minute, Vite at your next build.
- Connect your repository and Persqo opens a pull request for file fixes such as llms.txt and robots.txt. You review and merge it; Persqo never merges.
Turning findings into good prompts is covered in bug reports to Claude Code fix prompts. More on Persqo for Claude Code.
Sources
- How Claude remembers your project, Claude Code docs, checked November 6, 2026
- The vibe coding master checklist, Supabase blog, checked November 6, 2026
- Row Level Security, Supabase docs, checked November 6, 2026
Last updated: November 6, 2026.
Questions people ask
What should I check first before launching a Claude Code project?
Open the deployed URL on a phone in a private window and try to do the one thing a customer comes for, such as sign up, book or buy. If that fails, fix it before anything else on the list.
Can Claude Code check its own work before launch?
It can run your tests, linters and builds and review code you point it at. It does not see your site the way a stranger on a phone does unless you give it a browser tool, so add at least one real walk-through by a person or an outside test.
How do I stop secrets from leaking in a Claude Code app?
Keep keys in environment variables on the server, never in client code or the repository. Ask Claude Code to search the built output for key patterns, add .env files to .gitignore, and rotate any key that was ever committed.