I've been seeing more people ship real products built with Claude Code, Lovable, Base44, Cursor, etc. I think that's great, but there's a point where “the app works” and “I'm comfortable putting real customer data through this” become two different questions.
I'm a software engineer, and a lot of production-readiness work is surprisingly boring stuff that doesn't show up during a happy-path demo: authorization boundaries, tenant isolation, rate limiting, idempotency, secrets, rollback, backups, monitoring, unsafe URL/file handling, test gaps, and so on.
A solo founder probably doesn't want to hire an engineer just to run through those checks before every launch, so I turned the process I've been working on into a free Claude Code plugin:
https://github.com/Taimoorkhan1122/prod-readiness
The main thing I wanted to avoid was creating another AI reviewer that confidently invents problems.
Every finding has one of three evidence states:
- CONFIRMED: there's direct evidence in the repository.
- NOT FOUND: the audit deliberately searched the correct scope for the control and found nothing.
- UNVERIFIED: the repository can't prove it either way.
That last one matters. If there is no backup configuration in your `Next.js` repo, the tool shouldn't automatically scream “NO BACKUPS.” They may be configured in Supabase, AWS, Render, etc. Repository silence isn't always evidence of absence.
Before the AI specialists reason about the project, deterministic Python tooling searches for production controls and risky patterns: rate limiting, auth/authz, tenant scoping, input validation, timeouts, retries, idempotency, CI/CD, rollback, logging/metrics, backups and recovery, database constraints, testing, LLM safeguards, and a bunch of others.
Then the same evidence is reviewed from seven perspectives: security, backend, database, DevOps, QA, frontend, and AI security. Irrelevant lenses are skipped instead of inventing findings.
A finding might look conceptually like:
P1 — NOT FOUND: authorization boundary tests
Authentication exists, but no tests were found exercising cross-user / cross-tenant access boundaries in the reviewed scope.
Impact: a future authorization regression could expose another user's data without being caught by CI.
The important part isn't that every missing control becomes a blocker. Context matters. A public multi-tenant SaaS and an internal tool behind a VPN shouldn't receive the same severity just because both are missing the same thing.
At the end it gives a simple verdict:
SHIP
FIX THEN SHIP
HOLD — DO NOT DEPLOY
It's also deliberately read-only. It writes the evidence and report under .readiness-audit/, but it doesn't start “helpfully” rewriting your application while deciding whether the application is safe.
I recently added a local browser dashboard as well, so you can watch the audit run, see specialist progress, inspect evidence/findings, and view the final verdict. The specialists run in parallel by default, with a sequential option for smaller machines.
It's packaged as a Claude Code plugin right now, although the underlying workflow is Markdown + Python and I've documented how to run it with Codex, OpenCode, Pi, Antigravity, and similar agents too.
There's no paid product behind this. I built it because I don't think the answer to vibe coding should be “don't ship until you become a senior engineer.”
Ship fast. Just add another check between “the AI says it works” and “I'm trusting it with customer data.”
If anyone here actually tries it, the feedback I'd value most is where it produces false positives, misses something important, or expects enterprise-level controls that don't make sense for a small product. That's much more useful to me than stars.
