The privacy checklist we run before every launch

A new website can leak a lot without anyone noticing. We run the same checklist before every launch.

1. Strip image metadata (EXIF and GPS)
2. Remove source maps from production builds
3. No secrets or .env files in the public folder
4. No personal emails in the page source
5. No third-party trackers unless the client asks
6. No author or generator meta tags
7. Referrer policy set to protect outbound clicks
8. Domain WHOIS privacy turned on
9. Server time and logs in UTC
10. HTTPS with automatic redirect

Each check is automated in Kovalt Build. If one fails, the release is blocked until it is fixed.

Start a project