Should we test staging or production?

Last reviewed 2026-09-30Written by Jacob Masse, TrazTech Inc.

Staging, if it truly mirrors production: the same code, auth settings, database rules, storage policies and AI configuration, with realistic fake data. Many AI-built apps have no staging, or one with different database rules, which tests an app nobody uses. If you test production, agree test accounts, limits, excluded actions and an emergency contact in writing.

What staging must match

Same code version.
Same row level security or security rules.
Same storage bucket settings.
Same auth provider settings.
Same AI prompts, tools and permissions.

Testing production safely

Dedicated test accounts and a test organization.
No destructive actions on real data.
Payment testing in test mode or with agreed refunds.
Rate agreements so testing is not mistaken for an attack.
A contact reachable throughout.

Setting up a staging copy

For a Supabase app, create a second project and apply the same migrations and policies, so row level security is identical. For Firebase, a second project with the same deployed rules. Point a staging deployment of the front end at it, with its own keys. Seed it with realistic fake data: several organizations, several users per role, sample files and payments in test mode. Use the same AI prompts and tools, connected to test accounts rather than real email or payment systems.

Before the test, compare the two environments' policies and settings line by line. The most common reason a staging test misses a production problem is a rule someone fixed in one environment and not the other. Keep staging after the test: it is where you verify fixes and where future retests run.

Getting it checked

TrazTech offers vibe-coding QA and security review, listed from $2,000 CAD. Get at least one other quote on the same scope; the questions to ask a testing firm help compare them.

Get a scope for your app

Tell us what you built, what it stores and who is about to use it.

Get matched

Common questions

Do app builders support staging?

Several support separate projects or branches. A second Supabase or Firebase project with the same rules is a practical staging setup.

Will testing affect my real users?

It should not with the controls above, but tell them if you expect any disruption.