The production readiness audit

Q: How do I uninstall it?

To uninstall the readiness audit, delete its folder: rm -rf ~/.claude/skills/prostack-readiness ~/.agents/skills/prostack-readiness . The installer only adds that one folder, in Claude Code’s skills folder, the one Codex and Cursor read, or both, and it prints the exact paths when it finishes. Nothing else on your machine changes, so there’s nothing else to undo.

A skill for Claude Code, Codex, Cursor or any agent that supports skills. It reads your project without asking you anything, then shows you what running the app in production would take.

curl -fsSL https://prostack.ai/audit/install.sh | sh

Then open your project in your coding agent and type /prostack-readiness.

Read every file first See a sample summary

Read-only, and your code never reaches Prostack.

How it works

Four steps. Your agent does most of the reading.

Install the skill
One command in your terminal. It’s five plain-text files, and you can read every line first.
Ask for the audit
Open the project and type /prostack-readiness (in Codex, $prostack-readiness), or ask your agent for a Prostack readiness audit.
Watch it work
It doesn’t ask you anything. As it reads, it tells you what it’s found: your stack, where it runs, and anything worth fixing now.
Open the link
It writes nothing to your project. It ends with a link to a page that lays out every finding, with why it matters and what to do.

What you get back

A summary you can act on this afternoon, with or without us.

This excerpt is from a made-up internal quoting tool: a Next.js app on Vercel with Postgres on Neon, built by a small team with Claude Code.

Findings are ranked by what would hurt most if it broke tomorrow. Each says what’s wrong, why it matters, and a fix small enough to hand straight to your agent, which tells you the file as it goes.

The page also says where the app could live and what the move involves. It’s the only part that mentions us.

What the audit found

quote-builder · Next.js 15 · Stripe · Postgres (Neon) · Vercel

Fix now Secrets
A live Stripe secret key is in the git history
Anyone who can see the repository can take payments or issue refunds on your account. Roll the key in Stripe first, then keep the new one in the host’s settings.
Fix now Data access
Any signed-in user can read any quote
Quote IDs count up from 1, so anyone with a login can read every quote, with customer names and emails. Check a quote belongs to the user before returning it.
Fix now Monitoring
Fix soon Backups
Fix soon Dependencies
Fine Hosting fit
Fine Personal data
Fine Deploys
Fine Handover

What we see, and what we don’t

The skill makes no network calls. It reads your project, prints a link, and stops.

Never sent to us

Your source code, or any file name from it
Your .env files, keys and credentials
Anything in your database
Which file or line a finding is in

Sent only when you press send

The skill ends by offering a link. It opens a page on this site showing the summary on the right. You remove anything you’d rather not send, add your email, and send it.

See the form

The whole summary, decoded (the link carries it base64-encoded, so it fits)

{
  "v": 4,
  "app_name": "quote-builder",
  "stack": [
    "Next.js 15",
    "Stripe"
  ],
  "runtime": "Node.js 20",
  "database": "Postgres (Neon)",
  "current_host": "Vercel",
  "built_with": "Claude Code",
  "payments": "Stripe Checkout",
  "personal_data": "yes",
  "relies_on": [],
  "ratings": {
    "hosting-fit": "fine",
    "backups": "fix-soon",
    "monitoring": "fix-now",
    "secrets": "fix-now",
    "data-access": "fix-now",
    "dependencies": "fix-soon",
    "personal-data": "fine",
    "deploys": "fine",
    "handover": "fine"
  },
  "findings": [
    {
      "area": "secrets",
      "rating": "fix-now",
      "title": "A live Stripe secret key is in the git history",
      "detail": "Anyone who can see the repository can take payments or issue refunds on your account. Roll the key in Stripe first, then keep the new one in the host’s settings."
    },
    {
      "area": "data-access",
      "rating": "fix-now",
      "title": "Any signed-in user can read any quote",
      "detail": "Quote IDs count up from 1, so anyone with a login can read every quote, with customer names and emails. Check a quote belongs to the user before returning it."
    },
    {
      "area": "monitoring",
      "rating": "fix-now",
      "title": "Nothing alerts anyone when the app goes down",
      "detail": "If it stops, nobody hears until a customer says so. Add a health-check route and point an uptime monitor at it, alerting two people."
    },
    {
      "area": "backups",
      "rating": "fix-soon",
      "title": "Backups rely on Neon’s restore window, and a restore has never been tested",
      "detail": "A restore nobody has tried may not work on the day it’s needed. Take an export today, and test restoring it into a scratch database."
    },
    {
      "area": "dependencies",
      "rating": "fix-soon",
      "title": "Two packages have published vulnerabilities, one rated high",
      "detail": "Known vulnerabilities are what automated attacks look for first. Run npm audit and update what it flags."
    }
  ],
  "unknowns": [
    {
      "text": "Whether Neon’s point-in-time restore is switched on, and for how long",
      "detail": "The Neon dashboard shows it, so whoever owns that account can check."
    }
  ],
  "route": 1,
  "route_reason": "A standard Next.js app. The Postgres database stays on Neon, and the app keeps connecting to it.",
  "server": "Cloud 2",
  "server_reason": "The Next.js build runs on the server, and 2GB is tight for that."
}

Your app’s name and stack, each area’s rating, the findings and a suggested server, all read from the code. No file paths, code, keys or people’s names.

What it checks

The same ground our engineers cover when a new customer moves in, with extra attention on the things agents tend to skip.

Hosting fit

What the app needs to run, whether it runs on Prostack Cito as it is, and what size of server.

Backups

What gets backed up, where it goes, and whether a restore has ever worked.

Monitoring

Whether anything notices when the app goes down, and who it tells.

Secrets

Keys in the repository, in the git history, or bundled into the browser code.

Data access

Who can read what: an ownership check on every route, and the access rules on your database.

Dependencies

Packages with published CVEs, and how far behind current versions you are.

Personal data

Where customer details are stored, and who has a route to them.

Deploys

How code gets to production, and how you’d roll back a bad release.

Handover

How much of the app only makes sense to the one person who built it.

Questions

Who is it for?

The Prostack readiness audit is for developers and teams who build with coding agents and want a second opinion before an app carries real traffic. It covers the ground our engineers check when a new customer moves in, and each finding comes with a fix you can hand straight back to your agent.

Is it really free?

Yes, the Prostack readiness audit is free. It’s how we find the apps we’re a good fit for, and the findings are worth having whoever ends up hosting yours.

Will it change my code?

No, the readiness audit never changes your code. It only reads files, and writes nothing, not even a report: everything it found is in the link it prints. If you want a finding fixed, ask your agent to do it as a separate job, and check what it changes.

Which agents does it work with?

The readiness audit works in Claude Code, Cursor, Codex and any other agent that supports skills. It’s written as an Agent Skill, a folder with a SKILL.md file in it, which is the format they all read.

How do I uninstall it?

To uninstall the readiness audit, delete its folder: rm -rf ~/.claude/skills/prostack-readiness ~/.agents/skills/prostack-readiness. The installer only adds that one folder, in Claude Code’s skills folder, the one Codex and Cursor read, or both, and it prints the exact paths when it finishes. Nothing else on your machine changes, so there’s nothing else to undo.

Does my code go anywhere?

Your code never reaches Prostack. The audit runs inside your agent, and your agent sends your code to its model provider exactly as it does for any other task. That arrangement is between you and them, and the audit doesn’t change it.

What happens if I send you the summary?

Prostack reads it, and if it looks like we can help, we’ll get in touch by email. There’s no obligation either way, and you won’t be added to a mailing list.

The app isn’t live yet. Is it worth running now?

Yes, the audit is worth running before launch. Secrets and backups are far cheaper to sort before launch than after the first incident.

Rather talk it through?

A person will look at it with you. Bring the repo, or a description of what it does and what went wrong.

Talk to an engineer How we take an app on