Production readiness review
A fixed-scope review of your codebase before it meets real users, or before more of them arrive. You get a ranked list of what needs attention for production and how to fix it.
For: Founders and teams who built quickly with AI coding tools and want to know what is safe to ship.
Free, 30 minutes, no preparation needed.
What’s included
- Security review of auth, API routes, secrets and database access rules, against the OWASP Top 10
- GDPR check: what personal data you hold, where it goes, consent, retention, and whether users can export or delete it
- PII exposure and prompt-injection risks in AI features, against the OWASP Top 10 for LLM applications
- Error handling, edge cases and failure modes that haven't been tested yet
- Cost and performance traps such as unbounded model calls and N+1 queries
- A written report ranked by severity, with a fix plan
How the review runs
I start with access to the repository and the deployed app, and a short call about what the product does and who uses it. Then I follow the data: from the browser to the database and out to every third party, including the model provider. Where I can, I prove a finding by reproducing it against a staging copy instead of describing it in theory.
What you get
A written report. Every finding has a severity, the evidence, why it matters and how to fix it, with the critical items first. A walkthrough call goes through it with you, so nothing in it is a surprise. The report is yours: your team can work through it, or I can.
When it's the right first step
Start here if you're about to launch, about to raise, facing a customer's security questionnaire, or simply not sure what's safe to ship. It's fixed scope, so the cost is known before it starts, and it tells you whether the next step is a handful of fixes or something bigger.
What it isn't
It isn't a penetration test or a legal compliance audit. I review the code and the running app as an engineer. If you need a formal pentest or legal sign-off, I'll tell you, and point you to a specialist.
How it works
- 01
Talk
A call about what you have, what is breaking and what has to ship.
- 02
Scope
An audit or a short spec with acceptance criteria, so we agree on done before any code.
- 03
Build
Small, reviewed pull requests against the spec, deployed to previews you can click through.
- 04
Hand over
Docs, tests and a walkthrough, so the codebase is yours, not mine.
Got a demo that needs to survive real users?
Tell me what you have and what has to ship, on a call or by email with a link to the repo or the live app. I'll tell you honestly whether I can help, and what I'd look at first.