Production launch
NO-GO
static readiness cannot launch production.
F070 · production security
Production security hardening
Tracks CSP, iframe sandbox validation, postMessage allowlist, rate-limit fixtures and token redaction regression.
Scope
F070 report
Blocked phases
1
Warning phases
0
F070
Production Security Hardening
Security rules are fail-closed until iframe sandbox, CSP, origin allowlist, rate limit and token redaction are proven in browser and backend.
Required evidence
- • CSP example tested on plain HTML host
- • iframe sandbox policy verified
- • postMessage source/origin allowlist verified
- • rate-limit/quota abuse fixture
- • no-token-in-DOM/URL/screenshot regression
WARNING
CSP examples
CSP guidance exists but must be tested against real embed domain.
WARNING
iframe sandbox validation
Sandbox flags are set by loader; browser fixture evidence is pending.
BLOCKED
Token redaction regression
No production approval until DOM/URL/screenshot scan passes in Playwright/manual browser QA.
Global production gates
BLOCKED
Frontend green gate
Run pnpm install/typecheck/lint/build/test/dev/test:e2e in local or staging.
BLOCKED
Backend green gate
Run npm ci, prisma generate/validate, typecheck, lint, test, start/dev and migration check.
BLOCKED
Browser/embed QA
Plain HTML, Next.js, WordPress-like, mobile, multi-widget and no-token checks require real browser evidence.
BLOCKED
Security/observability evidence
Token redaction, CSP, iframe sandbox, postMessage allowlist and trace id propagation must be proven.
WARNING
Release/docs evidence
Customer install guides, troubleshooting, known limitations and rollback docs need final review.
Launch blocking reasons
- Blocker 1
- F066: Production Deployment / Environment Freeze is WARNING / not production-promotable from static evidence.
- Blocker 2
- F067: Observability / Logs / Metrics / Trace IDs is WARNING / not production-promotable from static evidence.
- Blocker 3
- F068: Versioned Embed Compatibility Contract is WARNING / not production-promotable from static evidence.
- Blocker 4
- F069: Customer Onboarding / Install Guide QA is WARNING / not production-promotable from static evidence.
- Blocker 5
- F070: Production Security Hardening is BLOCKED / not production-promotable from static evidence.
- Blocker 6
- F071: Production Data Reliability is BLOCKED / not production-promotable from static evidence.
- Blocker 7
- F072: Regression Suite Freeze is WARNING / not production-promotable from static evidence.
- Blocker 8
- F073: Release Candidate / RC1 is BLOCKED / not production-promotable from static evidence.
- Blocker 9
- F074: Beta Feedback / Bugfix Window is WARNING / not production-promotable from static evidence.
- Blocker 10
- F075: Production Launch Readiness is BLOCKED / not production-promotable from static evidence.
Commands required outside sandbox
- Command 1
- pnpm install
- Command 2
- pnpm typecheck
- Command 3
- pnpm lint
- Command 4
- pnpm build
- Command 5
- pnpm test
- Command 6
- pnpm dev
- Command 7
- pnpm test:e2e
- Command 8
- npm ci
- Command 9
- npx prisma generate
- Command 10
- npm run prisma:validate
- Command 11
- npm run typecheck
- Command 12
- npm run lint
- Command 13
- npm run test
- Command 14
- npm run start:dev
- Command 15
- migration check
Next safe action
Run F066-F075 as a production-track readiness/handoff, then collect real local/staging frontend, backend and browser evidence before RC1 or production launch.