We ran 25 production-readiness checks across security, AI risk, reliability, operability, and cost — plus a stack risk analysis, an operating-skills assessment, and an enterprise readiness track. Here's where you stand, and the five fixes that matter most before real users arrive.
Typical for AI-assisted builds: the product logic is solid, but 3 critical and 5 high findings would be exploitable or expensive within days of a public launch. Most are fixable in under two weeks.
Ranked by severity × exploitability. Everything else can wait until after these are closed.
Your production key is in .env.local, which is tracked in git history. Anyone with repo access — or a leaked clone — can bill your account directly.
If launched today: key scraping bots typically exploit exposed keys within hours; unbounded spend on your OpenAI account.
API routes verify that a user is logged in, but not that they own the record requested. Changing the ID in /api/projects/[id] returns any user's project — a classic pattern in AI-generated CRUD code.
If launched today: full customer data exposure; reportable breach in most jurisdictions.
Model calls have no max_tokens, no per-user quota, and no rate limiting. One malicious user with a loop can generate a four-figure API bill overnight.
If launched today: uncapped cost exposure tied directly to public traffic.
Free-text input is concatenated into your system prompt in lib/ai/generate.ts. Prompt injection lets users override instructions, extract your prompt, or generate off-policy content under your brand.
If launched today: reputational risk and guardrail bypass on day one.
There is no Sentry, App Insights, or equivalent. External API failures are silently swallowed in 14 locations. Your first alert will be a customer complaint.
If launched today: outages discovered by users, not by you; no data for debugging.
Score reflects weighted checks passed within each category.
Full check manifest. Passed checks are included so you can see what's already solid.
| ID | Severity | Finding |
|---|---|---|
| Security | ||
| SEC-01 | Critical | Secrets committed to repository (OpenAI key, Supabase service role) |
| SEC-02 | Critical | Missing ownership checks on authenticated endpoints (IDOR) |
| SEC-03 | High | CORS allows all origins with credentials enabled |
| SEC-04 | Medium | 2 dependencies with known CVEs; 1 unresolvable package name |
| SEC-05 | Medium | Missing security headers (CSP, HSTS) |
| SEC-06 | Pass | No raw SQL interpolation — ORM used consistently |
| SEC-07 | Pass | No secrets in client bundle |
| SEC-08 | Pass | File uploads validated for type and size |
| AI Risk | ||
| AI-01 | Critical | No token limits, quotas, or rate limiting on LLM calls |
| AI-02 | High | Prompt injection: user input concatenated into system prompt |
| AI-03 | High | LLM output rendered as raw HTML (stored XSS vector) |
| AI-04 | Medium | No moderation layer on user-facing generation |
| AI-05 | Pass | Model calls made server-side only |
| Reliability | ||
| REL-01 | High | External calls lack timeouts and retries in 14 locations |
| REL-02 | Medium | Check-then-act race condition in credit deduction logic |
| REL-03 | Pass | Health check endpoint present |
| REL-04 | Pass | Request bodies validated with zod at API boundaries |
| REL-05 | Pass | Database connection pooling configured |
| Operability | ||
| OPS-01 | High | No error monitoring or alerting integration |
| OPS-02 | Medium | No tests on auth or payment paths (4% overall coverage) |
| OPS-03 | Medium | Dev and prod share one database and key set |
| OPS-04 | Pass | CI/CD pipeline deploys from main with build checks |
| OPS-05 | Pass | Structured logging present in API layer |
| Cost & Data | ||
| CST-01 | Pass | No PII detected in log output |
| CST-02 | Pass | Storage buckets private; service roles scoped |
Beyond bugs: how risky are the technologies this app is built on — maturity, lock-in, licensing, and whether they'll survive your growth.
Mature, huge talent pool, strong upgrade path. Main caution: app is pinned to a deprecated minor version — schedule the upgrade before the gap widens.
Solid choice at this stage, but the app bypasses Row Level Security in 6 queries using the service role key — this defeats Supabase's core security model and couples you to it incorrectly. Migration path to self-hosted Postgres exists but auth migration is non-trivial.
Your core feature depends on one model provider with no abstraction layer — calls are made directly in 11 files. A pricing change, deprecation, or outage hits revenue directly. Route calls through one internal module so a second provider can be added in days, not weeks.
2 packages with known CVEs, 4 unmaintained (no release in 2+ years), 1 package name that doesn't resolve — a hallmark of AI-suggested imports. 3 packages have a single maintainer (bus-factor risk). One copyleft-licensed package (GPL-3.0) is incompatible with a future commercial licensing model and should be replaced.
The skills your team needs at each stage — what you have, what's partial, and what's missing. Vibe-coding got you here; these capabilities get you to the next stage.
| Capability | Launch (now) | Growth (~1K users) | Enterprise |
|---|---|---|---|
| Secure coding & review | Gap | Gap | Gap |
| CI/CD & release management | Partial | Gap | Gap |
| Monitoring & incident response | Gap | Gap | Gap |
| Cloud cost management | Partial | Partial | Gap |
| LLM ops (evals, guardrails, spend) | Gap | Gap | Gap |
| Data management & backups | Have | Partial | Gap |
| Compliance & audit readiness | N/A | Partial | Gap |
The gates enterprise buyers will check before signing. Not urgent today — but each gate takes weeks to months, so know the runway before you pursue that first big logo.
Deop's engineers fix everything above the line, set up monitoring and spend controls, and hand you a re-scan showing green — fixed price, no retainer required.