Checklists for developers

A release checklist for fast websites, organised around the three Core Web Vitals and the guidance on web.dev. Each check says how much it matters and exactly how to confirm it, from field data and server response time to the LCP image, long tasks, layout shifts, fonts, the back/forward cache and monitoring after release.

• Web
• Frontend

A release checklist for web apps and APIs, organised around the OWASP Top 10:2025 and the OWASP cheat sheets. Each check tells you how much it matters and exactly how to confirm it is done, from access control and sessions to headers, dependencies, logging and file uploads.

• Security

A release checklist for making a website or web app usable with a keyboard, a screen reader, zoom and reduced motion. It follows WCAG 2.2 level AA, including the criteria new in 2.2, and every check says how much it matters and exactly how to confirm it, from page structure and focus to contrast, forms, ARIA and testing.

• Web
• Frontend

A supply chain security checklist you can run against a real repository and its pipeline. It covers what you install (lockfiles, pinning, install scripts, update bots, dependency review), how you build (CI permissions, secrets, actions pinned by SHA, protected branches) and what you ship (SLSA provenance, Sigstore signatures, SBOMs, registry publishing), plus a drill for the day a package you depend on is compromised.

• Security
• DevOps

A step-by-step checklist for developers who want to sell digital products such as code templates, starter kits, e-books, courses or plugins. It covers choosing and validating a product, writing a licence, picking a platform (Gumroad, Lemon Squeezy, Paddle or Stripe), how a merchant of record changes your tax work, pricing, delivery, refunds and support, marketing and keeping the product updated. It is practical guidance, not legal or tax advice.

• Career
• Freelancing

A practical checklist for getting and keeping a remote developer job, often with a company in another country. It covers checking that an employer is real, understanding whether you are an employee or a contractor, the contract clauses that matter, getting paid across borders, your home setup and security, working across time zones, writing for asynchronous teams, staying visible and protecting your health. It is practical guidance, not legal or tax advice.

• Career

A step-by-step checklist for software engineers moving to another country for a job. It covers researching work visa routes on official government sites, checking a job offer and sponsoring employer, avoiding immigration and job offer scams, preparing documents, planning money and taxes, the weeks before you fly, and the registrations and habits that matter in your first weeks. It is general guidance, not immigration or legal advice.

• Career

A checklist for taking retrieval-augmented generation from demo to production. It covers ingestion and chunking, document permissions and injection, embeddings and indexes, hybrid search and reranking, grounded answers with citations, retrieval and answer evals, freshness, monitoring and cost, with a severity and a verification step for each check.

• AI
• Data

A checklist to go through before you open or mark a pull request ready for review. It is built on Google's published guidance for authors and GitHub's pull request documentation, and each check says how much it matters and exactly how to confirm it, from the size of the change to tests, the description, release safety and responding to review.

• Web
• Programming

A production readiness review you can run before launch, or on a service you just inherited. Each check has a severity and a concrete way to verify it, covering ownership, reliability and capacity, observability and alerting, deployment and rollback, data and recovery, security and incident response.

• DevOps
• Backend
• Cloud

A step-by-step checklist for a developer portfolio website. It covers the opening that tells visitors who you are, how to present three to five projects with problem, role, stack and outcome, live demos and code links, performance against Core Web Vitals, accessibility against WCAG 2.2, SEO and link previews, a custom domain with HTTPS, a working contact route, light analytics, and keeping the site current.

• Career
• Personal branding

A step-by-step open source contribution checklist, from choosing a project to getting a pull request merged and becoming a regular contributor. It covers project health signals, CONTRIBUTING files and sign-off rules, claiming issues, the fork and branch workflow, writing a pull request maintainers can review quickly, handling feedback, and reporting security problems the right way.

• Career
• Open source

A mobile app security checklist for Android, iOS, Flutter and React Native apps, organised by the eight OWASP MASVS categories. Every check says how much it matters and how to verify it on a real build, using platform tools or the techniques in the OWASP Mobile Application Security Testing Guide.

• Mobile
• Security

A checklist for taking a trained machine learning model into production and keeping it healthy there. It covers baselines and metrics, training and serving consistency, offline validation, packaging and the model registry, staged rollout and rollback, monitoring for skew and drift, and ownership, with a severity and a verification step for each check.

• Data
• DevOps

A checklist for evaluating LLM features and agents before and after launch. It covers success criteria, building the eval dataset, choosing and calibrating graders, running evals reproducibly, agent and multi-step evals, safety and security tests, and production monitoring, with a severity and a concrete verification step for each check.

• AI
• Testing

A checklist for cutting what you spend on LLM APIs without cutting quality. It covers measuring cost per request and per feature, routing work to smaller models, prompt caching, batch APIs, trimming context, limiting output, caching whole responses, retries and rate limits, and budgets with alerts, each with a severity and a concrete way to verify it.

• AI
• Cloud

A Linux server hardening checklist for a VPS or cloud VM that runs your app. It covers user accounts and sudo, SSH, security updates, open ports and the firewall, system settings and permissions, logging, and checking the result against a CIS benchmark, with a command to verify every check.

• Security
• DevOps
• Cloud

A section-by-section LinkedIn profile checklist for developers and CS students. It covers the parts recruiters and hiring managers look at first, how to write experience as outcomes, how Open to Work visibility really works, and the privacy settings worth checking before you start a job search.

• Career
• Personal branding

A practical checklist for software engineers on both sides of a layoff. Before: build a cash buffer, keep copies of your own documents and contacts, record your work and keep your profiles current. On the day and after: read the severance and exit terms before signing, sort out health cover and unemployment support, secure references, look after yourself, and plan the search. Local rules differ, so it points you to official labour and government pages instead of giving legal advice.

• Career

A pre-launch verification list for a workload going to production on Kubernetes, and for the cluster it lands on. Each check has a severity and a command or test that proves it, covering cluster version and access, resources, probes, availability, Pod security, RBAC and network policy, secrets and images, autoscaling, and backups of cluster state.

• DevOps
• Cloud
• Security

A step-by-step checklist for reading, comparing and accepting a software job offer. It covers working out total compensation, the basics of stock options and vesting, the contract clauses that matter (notice, probation, IP, non-compete), benefits and leave, remote and location terms, the team and growth you are signing up for, negotiating without burning bridges, and getting every promise in writing. It is practical guidance, not legal, tax or financial advice.

• Career
• Job search

A practical checklist for developers turning a side project into a product people pay for. It covers validating the problem before building, cutting the first version down to something you can ship, a landing page that explains the product, taking payments and the basics of sales tax and income tax, privacy and terms pages, simple analytics, choosing launch channels, supporting your first users and iterating from what they do. It is practical guidance, not legal or tax advice.

• Career

An incident response checklist for software teams, covering both outages and security incidents. It walks through preparation, detecting and declaring an incident, roles and coordination, mitigation, security containment and evidence, communication, and closing with a blameless postmortem, with a way to check each item before you need it.

• DevOps
• Security
• Cloud

A part-by-part GitHub profile checklist for developers and CS students. It covers the profile basics, a profile README that earns its space, choosing and presenting pinned repositories, READMEs that let a stranger run your project, licences and repository hygiene, why contributions do or do not appear on your graph, keeping your email private, and securing the account.

• Career
• Dev tools