Pre-launch checklist for a site built with OpenAI Codex

Codex can write, test and review your code, but not see your live site through a stranger's phone. Before launch: walk the main path on the deployed URL, then check forms, secrets, data access, SEO and AI search basics, errors and legal pages, with a Codex task for each.

Short answer: before launch, open the deployed site on a phone in a private window and do the one thing a customer comes for. Then give Codex one task per area: list every form and its error states, find any secret that reaches the browser or git, show how each route checks that the user owns the data, give every public page a title, description and server-rendered text, add a sitemap and robots.txt, wire up error tracking and analytics, and add privacy and terms pages. Review each diff, and put the rules in AGENTS.md so later tasks keep them.

1. The main path, on the live site

Codex works in your repository. Your customers work on your deployed site, on their phones. Before anything else:

Open the live URL in a private window on a phone.
Sign up, book, buy or contact, whatever the site is for.
Note anything that made you hesitate.

2. Forms and emails

Task for Codex: "List every form, what it sends, and each error message. Flag errors that do not say what to fix and forms that can be submitted twice." Then submit each form yourself on the live site and check the email arrives from your domain with a working link.

3. Secrets

Task: "Search the repository, git history and the production build for API keys and tokens. List each, where it is used, and whether it reaches the client. Do not print the values." Rotate anything that was ever committed.

4. Data access

Task: "For every API route and database query, show how it checks that the signed-in user may read or change the data. List routes with no check." If you use Supabase, confirm row level security is on with policies for every table that holds user data, and test it with two accounts.

5. SEO and AI search basics

Task: "Make sure every public page is rendered to HTML on the server or at build time, with a unique title, meta description, canonical URL and Open Graph tags. Add sitemap.xml and robots.txt with a Sitemap line on our production domain." Then check robots.txt does not block OAI-SearchBot; OpenAI's docs say blocked sites are not shown in ChatGPT search answers.

6. Errors, speed and analytics

Add an error tracker and check the browser console on each main page.
Run Lighthouse on the home page on a mobile profile and fix the largest items.
Check that your key events fire on the live domain.

7. Legal and trust

Privacy policy and terms in the footer, a real contact method, and a consent banner if your analytics and audience need one.

Write it down in AGENTS.md

OpenAI's docs say Codex reads AGENTS.md from the project root down to your working folder before it starts, with files closer to the task taking priority, up to a default combined size of 32 KiB. Put your launch rules there. Our guide to an AGENTS.md that keeps a Codex site shippable has a template.

Where Persqo helps

You can do this list with Codex alone. Persqo adds the stranger's view:

Paste the Persqo prompt into Codex (the CLI, the IDE extension or a cloud task) and your app gets a Persqo admin page at /admin/persqo. Your key goes in a server-only environment variable, never in the prompt.
An AI visitor tests the live app on desktop and mobile, with screenshots and a replay, and every finding comes with a fix prompt for Codex. Persqo fills in forms but does not send them unless you opt in. There is no verification step for you: Persqo confirms the site is yours in the background.
One click: on a Next.js or Vite app, the Persqo fix runtime the prompt adds applies the home page title and description, business and FAQ schema and llms.txt, each with Undo. Next.js shows them within a minute, Vite at your next build.
Connect your repository and Persqo opens a pull request for file fixes such as llms.txt and robots.txt. You merge it; Persqo never merges.

Sources

Custom instructions with AGENTS.md, OpenAI Codex docs, checked November 6, 2026
Overview of OpenAI crawlers, OpenAI docs, checked November 6, 2026
The vibe coding master checklist, Supabase blog, checked November 6, 2026

Last updated: November 6, 2026.

Questions people ask

Can Codex test my site before launch?

Codex can run your tests, linters and builds, and write end to end tests for you. It works in your repository and its environment, so it does not replace a walk through the deployed site on a real phone by someone who did not build it.

Where do I put launch rules for Codex?

In AGENTS.md at the root of your repository. OpenAI's docs say Codex reads AGENTS.md files from the project root down to the current folder before it works, so rules there apply to every task.

What is the most common pre-launch miss in agent-built apps?

Secrets and data access. Keys end up in client code and database rules are left open. Ask Codex to list every key and where it reaches the browser, and every route and how it checks the user owns the data.