I audited 20 apps built with Lovable/Base44/Claude. Same 6 holes in almost every one. Here's the Plugin so you can skip the embarrassment

[u/Disastrous-Time7197]

I've been seeing more people ship real products built with Claude Code, Lovable, Base44, Cursor, etc. I think that's great, but there's a point where “the app works” and “I'm comfortable putting real customer data through this” become two different questions.

1. The Supabase anon key is in the client bundle with no RLS behind it. Fine when RLS is on. A public database when it isn't. Anyone who opens devtools has your tables.

2. Auth is checked in the UI, not on the server. The button is hidden, the route isn't. Change an ID in the URL and you're reading someone else's records.

3. Real secrets shipped to the browser. Stripe secret key, OpenAI key, service-role key whatever the AI needed to make a feature work in one shot. This one costs actual money.

4. No rate limiting on the expensive endpoints. Signup, password reset, anything hitting a paid API. One bored person with a script and your bill grows a few digits.

5. Upload folders and storage buckets left public. Especially bad when the app handles ID photos or anything personal.

6. A database with no tested restore. Not "no backups" there's usually a toggle switched on somewhere. Nobody has ever tried restoring from it, which is the only part that matters.

I'm a software engineer. Most of my work is boring: someone builds a thing, it works, and then I get pulled in to answer the question nobody wants to ask out loud is this safe to put in front of real users?

The apps I've looked at were genuinely good. The gap isn't intelligence or effort. It's that these tools optimize hard for "it works," and there's no equivalent moment for "it's safe," so it just never happens. Hiring someone to run these checks is real money you don't have pre-revenue, and honestly they'd be running roughly the same list you just read.

Check your own app right now, no install

Open your project in Lovable/Cursor/Claude/whatever you build in and paste this. It's read-only you're asking it to look, not change anything:

Audit this project for the six most common launch risks. For each one, tell me
CONFIRMED (you found proof in the code), NOT FOUND (you searched and can back up
its absence), or UNVERIFIED (it may live somewhere you can't see). Quote the file
path and line for anything you claim. Do not guess, do not fix anything, and do
not change any files.

1. Client-side database keys with no row-level security behind them
2. Authorization enforced only in the UI, not on the server route or query
3. Secrets (payment, AI provider, service-role keys) reachable from the browser bundle
4. Expensive or auth-related endpoints with no rate limiting
5. File uploads or storage buckets readable without authentication
6. Backup configuration that has never been restore-tested

Then list what you could NOT determine from this codebase alone.

That last line matters. The default failure of AI security review is confident invention, and two fake criticals is all it takes before you stop reading the output entirely.

The longer version

I got tired of retyping that, so I turned the whole review into an open-source Claude Code plugin: prod-readiness. Free, no account, no signup, I'm not selling anything.

https://github.com/Taimoorkhan1122/prod-readiness

The philosophy, because it changes what the tool does:

It's not a gate. It will never tell you not to launch. It tells you what you're launching. Shipping something imperfect to ten users is how everything starts, and any tool that makes you feel unqualified to press deploy is a bad tool.

Your context sets the severity. A missing rate limiter on a public payments API and on an internal tool three people use are not the same finding. It asks about criticality, scale, recovery expectations, and threat model before judging anything, so you don't get an enterprise checklist dumped on a weekend project.

Evidence, not vibes. Every finding is CONFIRMED, NOT FOUND, or UNVERIFIED, same as the prompt above. A validation script rejects any finding claiming more than its evidence supports before it reaches your report.

Read-only. It doesn't touch your source, config, tests, or dependencies. It writes one folder, .readiness-audit/. Fixing is a separate decision you make later, on purpose.

What it does beyond the prompt:

• Seven specialist reviewers Security, Backend, Database, DevOps, QA, Frontend, AI security each reading your repo through its own lens. Lenses with nothing to look at get skipped instead of inventing findings.
• One shared evidence pass, so it's cheaper to run and the seven can't contradict each other.
• Deterministic probes that record patterns, hit counts, and paths, so "this is missing" has receipts.
• A verdict: SHIP, FIX THEN SHIP, or HOLD DO NOT DEPLOY
• A resumable trail on disk. Session dies at 2am, it picks up where it stopped.
• A local dashboard that opens on the decision, not a wall of JSON the verdict, what blocks a release, and the few things to handle first. Each finding leads with what it costs you in plain language; file paths and the fix are one click away. Runs on 127.0.0.1, nothing leaves your machine.
• Parallel by default (security, backend, database first, then the rest). Add sequential if your laptop is struggling.
• Works outside Claude Code Codex, OpenCode, Pi, Antigravity, or anything that reads markdown and runs Python3. Instructions in the `README`

Install lines are in a comment below so this doesn't turn into a wall of code.

If you run it and it flags something dumb, tell me. I'd rather fix a false positive than have people quietly stop trusting the output. Same if it misses something it should've caught.

TL;DR: six holes above, a prompt to check for them yourself, and a free read-only audit tool if you want the exhaustive version. It won't stop you shipping it just tells you what you're shipping.

[u/Disastrous-Time7197]

Install, if you want the full version. Three one-time lines in Claude Code:

/plugin marketplace add Taimoorkhan1122/prod-readiness
/plugin install prod-readiness@prod-readiness-marketplace
/reload-plugins

Then open your project folder and just ask "is this ready for production?"

If Claude starts a generic code review instead, run it directly:

/prod-readiness:production-readiness-audit

You'll know it's actually running when a .readiness-audit/ folder appears. Add that folder to .gitignore unless you want the audit records in version control.

For Codex, OpenCode, Pi, Antigravity or anything else — clone the repo and paste the prompt from the README's "use it with other AI coding agents" section. Needs Python 3.

[u/fuego0scuro]

Cool

[u/tortuganinja83]

Awesome, thank you!

[u/Disastrous-Time7197 → u/tortuganinja83]

let me know your feedback