Is my app production-ready?
Your app works. You can demo it. That is not the same as being able to put real users, real money and someone else's data through it — and the gap between the two is usually made of twelve specific things. Here they are, as a sheet you can work through yourself.
- An observation, not an opinion. Each of the twelve names what to look at and what you should already be holding if the answer is yes.
- An afternoon, not a project. No score and no weighting — an element is met or it is not.
- It is the standard we grade our own work against, published as it stands rather than as a summary of it.
Send me the sheet
Four pages, as a PDF you can print and mark up. One field, and it arrives in a minute.
We use it to send you the sheet. Nothing else, no list, and no second mail you did not ask for. Rather just ask a person? [email protected].
It works. It can't take real users yet.
Whoever built it, and whatever it was built with, week one turns up the same four things.
- 1Nothing holds the features together. Every change breaks something else.
- 2One customer, and their passwords, written into the code.
- 3Outside services wired straight in. One changes, the app breaks.
- 4Runs on one laptop and nowhere else.
None of these mean the app is bad. They mean it was built one feature at a time, each wired straight to whatever it needed — which is the fastest way to find out whether the idea works, and the slowest way to carry real users.
The twelve, at a glance
The sheet gives each of these a full page-section: what met looks like in detail, the evidence you should be holding, and a line to mark it. This is the summary.
| # | Element | Met when, in one line |
|---|---|---|
| 1 | Deployment and environments | A test copy and live are both running in your own cloud account, and you can reach both. |
| 2 | Automated checks on every change | Every change runs the checks before it can land, and a failing check blocks it. |
| 3 | Sign-in and roles | Authentication and authorisation are enforced on the server for every route and every record. |
| 4 | Customers kept apart | One customer's data cannot be read or written by another, and a test proves the attempt fails. |
| 5 | One core, one contained piece per outside service | Every third-party service is reached through one replaceable piece, and the core does not import it. |
| 6 | Secrets out of the code | No secret is in the repository or its history; each environment supplies its own. |
| 7 | Backups | Backups run on a schedule and a restore has actually been performed. |
| 8 | Logging and monitoring | Logs carry a request identifier and no secret; something watches the product and alerts a named person. |
| 9 | Tests | A documented command runs the suite; it covers the paths a user pays for and it is green. |
| 10 | Written security specification | The specification exists, the product has been checked against it, and you keep the report. |
| 11 | Handover notes and a recorded walkthrough | An engineer who did not build it can run, change and deploy it from the notes alone. |
| 12 | The open-source licence check | Every component is graded and the licence inventory is handed over with the version. |
And the thirteenth item, which is the one worth the most
It asks a different question from the twelve: not is it built right, but can you carry it on without the people who built it. Run it on your own app.
- Pick a feature you want that nobody has worked on yet. Ask your own AI coding tool for it, working from the repository and the handover notes exactly as they are. Nobody who built the app helps.
- The tool finds what it needs without being told where to look, and the change lands in one place rather than in five.
- The tests stay green — apart from the ones the new feature is meant to change, which the tool updates itself.
- It deploys, by the written path: test copy first, then live, with no manual step that is not written down.
- Nothing else breaks. Everything that worked before still works, under real use.
Where it fails tells you which of the twelve was not really met. The sheet has that mapping, and the rules that keep the marks honest.
A page of "not met" is not a problem. It's a plan.
Send us the app and we will tell you which of the twelve we would fix first and what it would take. That answer is free and comes back within two days.