pipeline.md

A living production-readiness checklist that plugs into your AI coding agent (Claude Code / Claude.ai / Cursor) and won't let it skip what ~90% of vibecoders skip — BaaS-first architecture, docs-first integrations, security, e2e tests, analytics and money safeguards.

Your code works on your machine. But is the product ready for real people and real money? pipeline.md is the map from "works for me" to "shipped and safe". The agent walks the project stage by stage, marks progress [ ] → [~] → [x], and refuses to deploy while any blocking 🔒 stage is open.

🇷🇺 Русская версия README — README.ru.md. Русский файл маршрута — pipeline.ru.md.

Why this exists

Everyone teaches you to write code. Nobody walks you across the gap between "it runs locally" and "it's in prod, secure, and earning". These are the stages people skip — priorities battle-tested on three products shipped to production (a SaaS, an app with real money, and a trading bot).

The point isn't the text — a generic checklist you can get anywhere. The point is that it's built into the agent's workflow so it can't be forgotten, and that it carries hard-won priorities (e.g. don't build your own backend — take a BaaS; attack your own prod before someone else does; one analytics event per onboarding step is mandatory; money needs safeguards, not zero-vulnerability promises).

What's in here (free, MIT)

pipeline.md — the route: 16 stages with closure criteria. Blocking stages marked 🔒.
CLAUDE.md / AGENTS.md — the agent rule (create the file, check every stage, don't skip blockers). Works the same on any LLM.
.cursor/rules/pipeline-md.mdc — the same rule for Cursor.

The stages (16)

1. Idea & hypothesis · 2. Architecture (BaaS-first) · 3. Secrets 🔒 · 4. Authentication · 5. Data & access (RLS) · 6. Integrations (docs-first) · 7. AI layer · 8. MVP + UX · 9. E2E tests 🔒 · 10. Security — attack your prod 🔒 · 11. Performance · 12. Product analytics 🔒 · 13. Observability & backups · 14. Money safeguards 🔒 · 15. Legal & privacy · 16. Ship to prod 🔒

Quick start (≤ 5 min)

Claude Code — copy pipeline.md and CLAUDE.md into your project root, then say:

Read CLAUDE.md and pipeline.md. What stage are we at and what's next?

Cursor — copy .cursor/rules/pipeline-md.mdc into your project's .cursor/rules/ and pipeline.md into the root. The rule applies automatically.

Claude.ai (Projects) — paste CLAUDE.md into Project Instructions, add pipeline.md to the knowledge, then ask it to drive the project by pipeline.md.

Origin

Within a day of launching the landing for this idea, another vibecoder fed it to their agent and it produced a near-identical file. Good — the idea should be free. This is the canonical, maintained version (with the RLS, performance, observability and money-safeguards stages that ad-hoc clones miss). Star it, fork it, use it.

Pro

The free checklist is the map. If you want the depth — the paid Pro pack has what a skeleton can't:

Ready-to-paste prompts for every stage (including "attack my prod like a hacker", generate analytics events, write e2e tests).
Money-safeguards playbook — server-side amount checks, manual moderation, rollback, anomaly alerts, an operations journal, with real incident examples.
Stack packs (stack-packs.md) — ready recipes: enabling RLS in Supabase and verifying "as another user", Playwright e2e templates + CI, an analytics event-naming schema, a secure server-side LLM proxy, an idempotent money webhook.
PDF onboarding, before/after examples, updates.

The free map is the same 16 stages and the same blocking mechanic. Pro differs in depth: expanded audit criteria in every stage, plus ready prompts/recipes to close them fast and with proof.

→ pipeline-md.pages.dev

Author & license

By Oskar Makarov. MIT — use it anywhere, keep the notice. PRs and war-stories welcome.