domains / families / devops / production-audit

production-audit

authentic

Audit a shipped repo for production-readiness gaps across RLS, webhooks, secrets, grants, Stripe idempotency, mobile UX, and deployment health.

When to use

• Use when the user asks "is this production-ready", "what would break in prod", "score my project", "what did I miss", "audit my repo", "ready to ship".
• Use right after merging a feature branch to `main` (helpful as a pre-deploy gate).
• Use before a public launch / Show HN post / investor demo.
• Use when `git log` shows >20 commits since the last `.commitshow/audit.md` was written.
• During active in-session coding — use `security-review` / OWASP-style for line-level patterns. This skill is for post-merge / pre-ship review.
• For library / scaffold-form repos — the engine handles **app form** best; libraries get a partial-substitute score.
• If `.commitshow/audit.json` already exists and is < 1 hour old, read that instead of re-running. Audit is rate-limited (anonymous: 20/IP/day · 5/repo/day · 2000/day global).
• Inside a private / non-GitHub repo — the audit pulls public GitHub signals, so private repos return a `not_found` error.

When not to use

• This skill does not replace environment-specific validation, testing, or expert review.
• The audit engine is calibrated for **deployed apps** with a live URL. CLI / library / scaffold form gets a partial-substitute score (max ~45/50 on the audit pillar) — fair but not flattering.
• Behind a corporate firewall blocking `*.supabase.co`, the API call fails. There is no offline mode — the audit relies on the public engine.
• Cold audit takes 60-90s. Cached audits (within 7 days) return instantly. `--refresh` force-bypasses cache (counts against rate limits).

Skill page

Source