Production Hardening Checklist

Use this checklist before exposing a QVTM integration to real customers.

Backend

• Provisioning token stored only in backend secret storage.
• Token rotation procedure documented.
• Customer/domain IDs validated before issuing invites or challenges.
• Challenge expiration enforced.
• Verifier evidence required before local session creation.
• Audit logs enabled for developer, operator, and invite actions.

Frontend and mobile

• No provisioning token in browser or mobile code.
• QR/challenge payloads treated as short-lived.
• User-facing errors do not leak internal IDs or tokens.
• Mobile approval failure does not create partial sessions.

SaaS operations

• Developers registered as SaaS entities only when they need operational access.
• Developer RBAC scoped to specific customers/domains.
• Admin Console remains operational; Developer Portal remains documentation/distribution.
• Release notes and compatibility matrix reviewed before SDK upgrades.

Release

• TypeScript release gate passes.
• Swift tests pass.
• Rust tests pass.
• Developer Portal build passes.
• Live E2E tested against staging before production.