StackPrism

Production checklist

Prisma production checklist: 5 checks before launch

5 checks for running Prisma in production: 1 must-do, 2 should-dos and 2 good-to-haves. Each one says why it matters, how to verify it and where the docs are.

Updated . Every check links the vendor’s own docs.

Check my repo

Must do (1)

  • Never pass user input to $queryRawUnsafe or $executeRawUnsafe

    The Unsafe variants build SQL from strings, so user input becomes SQL injection. The tagged $queryRaw sends values as query parameters.

    Verify from the command line

    A pass finds no Unsafe raw queries, or only ones built from constant strings.

    grep -rnE "queryRawUnsafe|executeRawUnsafe" --exclude-dir=node_modules .

    Read more on prisma.io

Should do (2)

  • Apply migrations with prisma migrate deploy in CI, never migrate dev in production

    migrate dev can reset the database.

    Verify from the command line

    Deploy scripts run prisma migrate deploy. This search should find no migrate dev, migrate reset or db push in anything that touches production.

    grep -rnE "migrate (dev|reset)|db push" package.json .github Dockerfile 2>/dev/null

    Read more on prisma.io

  • Leave password hashes and tokens out of query results

    Returning a whole user row sends secrets to whoever calls the endpoint; use omit or select.

    Check the code

    Sensitive fields are omitted by default on the client (or every user query uses select).

    const prisma = new PrismaClient({
  omit: { user: { password: true } },
});

    Read more on prisma.io

Good to have (2)

  • Size the connection pool for serverless

    When the app runs on serverless functions

    Each function instance opens its own pool; cap it or use a pooler.

    Check the config

    Each function instance keeps a small pool: connection_limit in the URL on Prisma 6, the driver adapter’s pool size (max) on Prisma 7, or the URL points at a pooler such as PgBouncer.

    DATABASE_URL="postgresql://<user>:<password>@<host>:5432/<db>?connection_limit=1"

    Read more on prisma.io

  • Add indexes for the fields you filter and sort on

    Without them, queries on a growing table scan every row and slow to seconds.

    Verify with SQL

    On PostgreSQL, large tables with many sequential scans and few index scans need an @@index for the fields you filter on.

    select relname, seq_scan, idx_scan, n_live_tup
from pg_stat_user_tables
order by seq_scan desc limit 10;

    Read more on prisma.io

Get the checklist for your whole stack

Design your stack or map your repo in StackPrism, and the Improve panel lists the checks for every technology on it and keeps track of what you’ve done. Building with an AI app builder? Start with the vibe coding checklist.

Vibe coding security checklistMap my repo