Observability
Log request ID, route, latency, status, model name, token counts, and failure category. Do not log full prompts with secrets or customer data.
Protected Module
Production Habits
The demo is the easy part. Production work needs safe secrets, logs, access control, backups, evals, and runbooks.
Secrets
Keep API keys and payment secrets in environment variables. Never put them in frontend code, screenshots, docs, or public repositories.
Access Control
Local demo access can use a verified order cookie. Production needs user accounts, sessions, authorization checks, and revocation.
Release Discipline
- Keep
.env.examplecurrent. - Write rollback steps.
- Save test data.
- Run evals before prompt changes.
Lab
Add health checks, safe structured logs, and a runbook to one project. Review it as if someone else must operate it tomorrow.