Public Launch Checklist

[Niicck]

Security and Credentials

• Follow up on security audit findings Security Audit #200
• Database Security Security Audit #200
  • Change master password
  • Update api username/password
  • Remove hardcoded auth in js code
  • Remove hardcoded auth in sql code
  • Create different passwords for prod vs dev deployments
  • Revisit catch-all "security definer" permissions on functions
  • restrict access to sensitive fields (like users emails) Security Improvements #400
  • move db into more secure VPC
• Change and secure places.api.here credentials Secure places.api.here.com credentials #414
• Add Security to Lambda Functions Add Security on Lambda Functions #466

Scalability

• Implement pgBouncer to manage postgres pool connections on prod
• Conduct load testing Stress Testing #289 Load Testing #399
• Check efficiency of sql queries/indexing
• Add database monitoring

City

• Get official austintexas.gov email for ctxfloods Get official austintexas.gov email for ctxfloods #401

Deployment

• Implement a database backup strategy beyond default AWS automation
• Disaster Recovery - process for rolling back a failed deployment Disaster Recovery Process #474
• Speed up Travis deployment time
  • emergency hotfixes must be implemented faster
• Orchestrate frontend and backend versions
  • latest version of frontend should always point to latest version of backend.
  • currently, there is a period of time during deployment when the 2 versions don't match, and this causes errors for users.
• Create IAM users for dev branch and prod deployments

App Features (Important)

• Double check our sentry logging strategy Add sentry error logging to backend #154
• Get rid of SuperAdminWorld/ALL community edge case bugs Community Admins for "All" and "Super Admin World" see no crossings #357
• Fix password reset process new user password reset process #386
  • Content Team: Welcome text. Click this link to initiate. Make language clearer.
  • Don't make people enter their email twice. Ideally.
  • Make a better first impression.

App Features (Nice to have)

• Update unsafe react lifestyle component methods Update unsafe lifestyle component methods #408
• Apply lat/lng input or location tracking to incident report form
• Row level security in postgres
• Make our timestamps consistent Make our timestamps consistent #413
• Get a devops email account instead of using personal email addresses
• Reconsider our db migrations library