lucidlabs-hq/pre-production

Pre-Production Check

Führe Security- und Quality-Checks durch bevor Code in Production geht.

Wann welchen Check?

┌─────────────────────────────────────────────────────────────────┐
│                                                                 │
│   MVP / Staging                   PRODUCTION DELIVERY           │
│   ─────────────                   ───────────────────           │
│   /pre-production mvp             /pre-production production    │
│                                                                 │
│   ✅ Quick Security Scan          ✅ Full Security Audit        │
│   ✅ Basic Vulnerability Check    ✅ Deep Vulnerability Scan    │
│   ✅ Essential E2E Tests          ✅ Full E2E Test Suite        │
│   ✅ Build Verification           ✅ Performance Check          │
│                                                                 │
│   Dauer: ~5 Minuten               Dauer: ~15-30 Minuten         │
│                                                                 │
│   Für: Interne Demos,             Für: Echte User,              │
│        Beta Testing,                   Paid Customers,          │
│        Staging Deploy                  Final Release            │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

Voraussetzungen

Strix Installation

# Via curl
curl -sSL https://strix.ai/install | bash

# Oder via pipx
pipx install strix-agent

# Environment Variables
export STRIX_LLM="anthropic/claude-sonnet-4-20250514"
export LLM_API_KEY="your-api-key"

MVP Check (/pre-production mvp)

Schneller Check für interne Demos und Staging:

1. Build Verification

cd frontend && pnpm run build

2. Type & Lint Check

cd frontend && pnpm run validate

3. Quick Security Scan

# Lokaler Code-Scan
strix --target ./frontend --scan-mode quick -n

# Oder gegen Staging URL
strix --target https://staging.your-app.com --scan-mode quick -n

4. Essential E2E Tests

cd frontend && pnpm run test:e2e -- --grep "@critical"

MVP Checklist

• [ ] Build erfolgreich?
• [ ] TypeScript/ESLint Fehler?
• [ ] Kritische Security Issues?
• [ ] Login/Logout funktioniert?
• [ ] Hauptfunktion nutzbar?

---

Production Check (/pre-production production)

Vollständiger Check vor echtem Production Deploy:

1. Full Build & Validation

cd frontend && pnpm run build
cd frontend && pnpm run validate
cd frontend && pnpm run test

2. Full Security Audit mit Strix

# Vollständiger Scan gegen Production-ähnliche Umgebung
strix --target https://staging.your-app.com \
  --instruction-file .strix/production-check.md \
  -n

3. Vulnerability Scan

# Mit spezifischen Anweisungen
strix --target https://staging.your-app.com \
  --instruction "Focus on: authentication bypass, injection attacks, access control, XSS, SSRF"

4. Full E2E Suite

cd frontend && pnpm run test:e2e

5. Performance Check (Optional)

# Lighthouse via agent-browser
agent-browser open https://staging.your-app.com
agent-browser evaluate "JSON.stringify(window.performance.timing)"

Production Checklist

• [ ] Build erfolgreich?
• [ ] Alle Tests bestanden?
• [ ] Keine kritischen Security Issues?
• [ ] Keine Injection Vulnerabilities?
• [ ] Keine Access Control Flaws?
• [ ] Keine XSS Vulnerabilities?
• [ ] Login/Logout/Auth Flow sicher?
• [ ] Sensitive Daten geschützt?
• [ ] Error Handling korrekt?
• [ ] Performance akzeptabel?

---

Strix Instruction File

Erstelle .strix/production-check.md für konsistente Checks:

# Production Security Check

## Target Information
- Next.js 16 Application
- Convex Database
- Better Auth Authentication

## Focus Areas

### Authentication
- Test login/logout flows
- Check session handling
- Verify JWT/token security
- Test password reset flow

### Authorization
- Test role-based access
- Verify API endpoint protection
- Check for IDOR vulnerabilities

### Injection
- Test all input fields
- Check API parameters
- Verify SQL/NoSQL injection protection

### Client-Side
- Check for XSS in user inputs
- Verify CSP headers
- Test for open redirects

### API Security
- Check rate limiting
- Verify CORS configuration
- Test for SSRF

## Exclude
- /api/health (public)
- Static assets

---

Workflow Integration

Development          Staging              Production
───────────          ───────              ──────────
/visual-verify   →   /pre-production  →   /pre-production
                     mvp                  production

Schnell              Quick Check          Full Audit
UI Focus             Security Basics      Complete Security

Vor MVP/Staging Deploy

/pre-production mvp

Vor Production Deploy

/pre-production production

---

Security Issue Response

Kritisch (BLOCKER)

| Issue | Aktion | |-------|--------| | SQL/NoSQL Injection | STOP - Sofort fixen | | Auth Bypass | STOP - Sofort fixen | | RCE Vulnerability | STOP - Sofort fixen |

Hoch

| Issue | Aktion | |-------|--------| | XSS (Stored) | Fix vor Production | | IDOR | Fix vor Production | | SSRF | Fix vor Production |

Mittel

| Issue | Aktion | |-------|--------| | XSS (Reflected) | Dokumentieren, zeitnah fixen | | Missing Rate Limit | Dokumentieren, zeitnah fixen |

Niedrig

| Issue | Aktion | |-------|--------| | Information Disclosure | Backlog | | Missing Headers | Backlog |

---

Referenzen

• Strix GitHub
• OWASP Top 10