Production Audit

Production audit

Run an external audit on the repo's shipped state — deployed URL, GitHub signals, secrets exposure, RLS gaps, webhook idempotency, indexes, observability, prompt injection, and ten other failure modes that AI-assisted projects routinely miss.

This is complementary to in-session security skills (security-review, vibesec, OWASP-style) — those scan the editor buffer while you're coding. This scans the deployed product after you commit. Use both.

When to invoke

• User says "is this production-ready", "what would break in prod", "score my project", "what did I miss", "audit my repo", "ready to ship".
• Right after merging a feature branch to main (helpful as a pre-deploy gate).
• Before a public launch / Show HN post / investor demo.
• When git log shows >20 commits since the last .commitshow/audit.md was written.

When NOT to invoke

• During active in-session coding — use security-review / vibesec for line-level patterns. Production-audit is for post-merge / pre-ship review.
• For library or scaffold-form repos — the engine handles app form best; libraries get a partial-substitute score.
• If .commitshow/audit.json already exists and is .commitshow/audit.json 2>&1

The `--source` flag is anonymous · it lets commit.show distinguish how
the call originated (skill vs raw CLI vs IDE plugin) for funnel
analytics. Drop the flag if you prefer; data is still collected
without it (just labeled `(unknown)`).

This also writes a human-readable `.commitshow/audit.md` next to it. Subsequent invocations should diff against the prior `audit.json` if it exists, so you can lead with "+5 since yesterday's audit" instead of just an absolute number.

If the user pointed at a remote URL instead of `.`, swap in the URL: `npx commitshow@latest audit github.com/owner/repo --json`.

### 2. Parse the envelope

The JSON envelope is stable (`schema_version: "1"`, additive-only). Read these fields:

| Field | Meaning |
|---|---|
| `score.total` | 0-100 production-readiness score |
| `score.delta_since_last` | change vs. parent snapshot · positive = improving |
| `score.band` | `strong` (80+) · `mid` (60-79) · `early` (
- 14-frame failure framework (RLS · webhook · secrets · indexes · observability · rate limit · prompt injection · hardcoded URLs · mock data · webhook signature · CORS · mobile zoom · column GRANT · Stripe API idempotency): documented in the engine source above.
- JSON schema: stable at `schema_version: "1"` · additive-only changes; breaking changes bump to `"2"`.
- CLI: 
- API: `https://api.commit.show/audit?repo=...&format=json` (no install needed for one-off audits).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [commitshow](https://github.com/commitshow)
- **Source:** [commitshow/production-audit](https://github.com/commitshow/production-audit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.