This checklist helps ensure product, design, and engineering consistency when implementing a new feature or updating the project. It combines product requirements, design, code, testing, and operational best practices.
- Problem statement and product vision are clearly defined
- Goals and success criteria (OKRs/KPIs) are documented
- Target audience and user personas are included
- User stories and acceptance criteria are written
- Feature list is prioritized (must-have / nice-to-have / out of scope)
- Functional requirements are detailed (inputs, outputs, workflows)
- Non-functional requirements are listed (performance, scalability, accessibility, compliance)
- Dependencies and external integrations are documented
- Risks, assumptions, and constraints are identified
- Metrics and analytics requirements are defined (e.g., GA events, dashboards)
- Release / rollout strategy is documented (feature flags, phased rollout, A/B testing)
- Stakeholders and ownership are documented
- PRD has been reviewed and approved by stakeholders
- Color palette is defined and documented
- Typography rules (font sizes, weights, hierarchy) are documented
- Spacing and layout grid system are defined
- Component library / design system is updated (e.g., Storybook, Figma components)
- Iconography set is consistent and documented
- Dark mode / accessibility (WCAG compliance) is reviewed
- Responsive design rules are applied and tested
- Visual consistency across pages/components is verified
- Branding guidelines (logos, assets) are up to date
- Design tokens (colors, typography, spacing) are exported to code if applicable
- Accessibility audit (contrast ratios, keyboard navigation, ARIA labels) is completed
- Usability testing feedback is reviewed and incorporated
- Design review and approval workflow is completed (Figma/Sketch sign-off)
-
README.md
is updated -
CHANGELOG.md
is updated - Commit messages follow Conventional Commits
-
pre-commit
hook is configured and working:- Linter (e.g., ESLint, Pylint)
- Formatter (e.g., Prettier, Black)
- Static Analyzer (e.g., SonarQube, Bandit)
- .editorconfig file exists and is configured
-
.gitignore
file excludes sensitive and build-related files -
CODEOWNERS
file is set (if team collaboration is required) -
CONTRIBUTING.md
is available and updated -
LICENSE
file is present and correct
-
Makefile
is up to date -
Dockerfile(s)
are updated -
docker-compose.yaml
is valid and up to date -
.env.example
is created/updated with new environment variables - Kubernetes manifests are updated (
deployment.yaml
,service.yaml
, etc.) - Release version number is updated according to Semantic Versioning
- CI/CD pipelines are updated (
.github/workflows
,.gitlab-ci.yml
, etc.) - All builds succeed without errors
- Rollback strategy and hotfix procedure are defined
- Release notes are written and published
- Unit tests are added or updated
- Integration tests are added or updated
- HTTP API tests (e.g., Hurl, Postman) are updated
- Load/performance tests are included (e.g., k6, Artillery)
- Security testing is performed (e.g., OWASP ZAP, snyk)
- Code coverage report is generated
- Coverage threshold is met
- Edge cases and error handling are tested
- Project documentation (e.g., MkDocs) is updated
- Swagger / OpenAPI spec is up to date
- System design diagrams (e.g., mermaid, PlantUML) are updated
- Database ER diagrams are updated
- ADR (Architectural Decision Record) files are written for major changes
- Product Requirements Document (PRD) is finalized and linked
- UI/UX documentation (e.g., Figma, user flow diagrams) is updated
- Support documentation (FAQs, internal guides) is updated
- Database migrations are created and tested
- Seed data is updated if required
- Schema representation (DBML, Prisma, Drizzle, etc.) is updated
- Indexes and constraints are documented
- Sample anonymized test data is available
- Analytics events are defined and tracked (e.g., GA, Segment, Mixpanel)
- Logging for business KPIs (conversion, retention, engagement) is in place
- Error tracking and crash reporting are configured (e.g., Sentry, Datadog)
- Post-release monitoring plan is documented (dashboards, alerts)
- Dependency audits are run (
npm audit
,pip-audit
, etc.) - Secrets and credentials are not hardcoded or committed
-
.env.example
matches.gitignore
protection - GDPR / data privacy compliance is reviewed (if applicable)
- Security headers and CORS policies are reviewed
- Auth, rate limiting, and permission rules are tested
- Feature flags are documented
- Internationalization (i18n) strings are updated
- Logging strategy and levels are reviewed
- Monitoring and alerting are configured (e.g., Prometheus, Sentry)
- Ownership of the feature/module is documented
- Stakeholder approvals are logged
Use this master checklist before release to ensure stability, maintainability, and production-readiness across product, design, and engineering.