Bubble SaaS Launch Checklist
Every item on this checklist has caused a real production incident in a real Bubble SaaS. Security, billing, performance, email, and the launch day sequence — run every item before you tell a single customer your product is live.
One Missed Item Can Cost You Your First Customer
Launch day is not the time to discover that your Stripe webhooks are pointing at the test app, your password reset emails are going to spam, or your privacy rules let users see each other’s data. This checklist exists because every item on it has been the cause of a real production incident in a real Bubble SaaS. Run every item before you flip the switch.
Security & Data Isolation
-
✓
Every data type has at least one privacy rule — zero types remain on the default “Everyone” setting
-
✓
Every app-specific data type has a workspace field that is set on every creation workflow
-
✓
Every search in every page and workflow has workspace = current_workspace as the first constraint
-
✓
Tenant isolation tested: User B in Workspace B cannot see any records from Workspace A
-
✓
All destructive workflows (delete, remove member, change role) have server-side role checks on Step 1
-
✗
No API keys, secret tokens, or sensitive values stored in visible-to-client data fields
-
✗
File uploads are not accessible via public direct URLs without authentication
Stripe Billing Integrity
-
✓
Stripe keys switched from sk_test_ to sk_live_ in all API Connector calls
-
✓
Stripe webhook endpoint updated to point to production Bubble URL (not the /version-test URL)
-
✓
All six webhook events handled and tested: checkout.completed, subscription.updated, subscription.deleted, payment_failed, payment_succeeded, trial_will_end
-
✓
Subscription status is set ONLY by webhooks — the checkout success redirect does not set billing state
-
✓
Plan limits enforced in both UI conditions and Step 1 workflow guards
-
✓
A live test payment completed successfully with a real card before announcing launch
-
✗
Stripe Customer Portal enabled for self-serve payment management
Performance & Infrastructure
-
✓
App is on Growth plan or above — no production SaaS on the shared Starter server
-
✓
Zero :filtered by expressions — all filtering uses search constraints
-
✓
All repeating groups are paginated to maximum 20 items
-
✓
Custom domain connected and SSL certificate active
-
✓
Session recordings installed (Hotjar or FullStory) to observe first users
-
✓
Error alerting configured — know about failures before customers email you
-
✓
Page load tested on 3G connection — dashboard loads in under 3 seconds
Email & Notifications
-
✓
All transactional emails tested end-to-end: invitation, welcome, password reset, billing alerts
-
✓
Email sender domain verified with SendGrid/Postmark SPF and DKIM records
-
✓
Emails land in inbox not spam — tested with Mail Tester or GlockApps
-
✓
Trial-ending email scheduled to fire 3 days before trial_ends_at
-
✓
Payment failed email includes direct link to Stripe Customer Portal for card update
The Day-Of Launch Order
Sign up a fresh test account. Create a workspace. Complete onboarding. Subscribe with a real card. Invite a team member. Create a record. Cancel. Every core flow in sequence. If anything breaks, fix it before announcing.
Send your waitlist the launch email before any public announcement. These are your warmest leads. Give them a 24-hour head start and a founding member discount. This generates your first conversions and creates social proof for the broader launch.
Hacker News Show HN, Product Hunt, relevant subreddits, LinkedIn, Twitter/X. Stagger by 2-3 hours. Respond to every comment personally for the first 24 hours. This is the highest-leverage thing you can do on launch day.
Stay at your computer for the first 6 hours. Watch session recordings in real time via Hotjar. When someone gets stuck, reach out directly. Fix critical bugs within 2 hours. A founder who is visibly present on launch day converts browsers into believers.
Ready to Build on Bubble?
Data model design, Stripe billing, multi-tenant architecture, and full SaaS builds — done right from day one by Pakistan’s leading Bubble.io team.
