Section 04 · Infrastructure & Setup
Environments
Environment tiers, configuration, protection, and deployment verification
This guide walks you through auditing a project's environment setup, configuration, and protection.
The Goal: Production Parity
Staging should behave exactly like production so bugs surface before release, not after. Dev environments should enable deep debugging. Non-production environments should be invisible to the public internet.
- Tiered — production, staging, and dev environments with clear workflows
- Parity — staging runs in production mode with matching env vars
- Debuggable — dev environments have verbose logging and stack traces
- Protected — staging and dev behind Cloudflare Zero Trust
- Verified — webhooks bypassing Zero Trust validate signatures
Before You Start
- Confirm you're in the target repository's root directory
- Have staging and dev URLs ready for browser testing
- Have Cloudflare account ID and API token available (for ENV-008)
- Have the user available for questions about environment architecture
environment-tiers
Production environment deployed, deployment method documented, visible in CI history
“How is production deployed — does the whole team know?”
Staging environment deployed, deployment method documented, visible in CI history
“Shipping straight to prod because staging is too painful?”
At least one dev environment for QA, method to deploy feature branches for testing
“Where does QA test feature branches before they hit staging?”
environment-config
NODE_ENV=production or equivalent, same build process as production
“Is staging running in dev mode and masking real prod issues?”
Dev mode enabled, debug/verbose logging, stack traces visible for debugging
“Are stack traces visible locally, or are devs debugging blind?”
Same env vars as prod except payment gateways (sandbox OK), email must use real provider
“What breaks in staging that works in prod due to different config?”
Log level info/warn/error, stack traces hidden from users, friendly error messages
“Are stack traces leaking to your users in production?”
environment-protection
Browser access requires authentication, verified via browser test and Cloudflare API
“Can someone stumble onto staging without any credentials?”
Webhook endpoints verify signatures before processing if bypassing Zero Trust
“Zero Trust bypass path — is it guarded, or a wide-open door?”