All third-party services are on production plans

Launching with sandbox or test-mode third-party integrations means the application appears functional but produces no real outcomes: Stripe test keys accept payment flows that charge nobody, email sandbox providers accept API calls that deliver nothing, and development OAuth apps reject real user tokens. CWE-798 and OWASP A05 cover misconfigured credentials as a security defect, but the business impact here is more immediate — users complete onboarding flows, enter payment details, and receive no confirmation, then churn. Every sandbox-mode integration is a silent conversion killer.

Verify each integration's production credentials before launch and trigger a real end-to-end test after switching.

// lib/stripe.ts — confirm production key
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!)
// STRIPE_SECRET_KEY must start with sk_live_, not sk_test_

Checklist: Stripe STRIPE_SECRET_KEY starts with sk_live_; Stripe webhook endpoint registered in production dashboard points to your production URL. Email provider uses production API key (not sandbox). OAuth apps (Google, GitHub) are production apps with your real domain in authorized redirect URIs. Storage buckets are production buckets, not development. After switching every credential, trigger a complete user journey: sign up, payment, confirmation email.