Free production-readiness audit. Honest A-F grade + fix plan.
Ten categories, ten plain-English scenarios, one honest grade. Covers authentication, secrets, backups, rate limiting, payment webhooks, monitoring, HTTPS, input validation, access control, and dependencies. The specific 10 that cause 80 percent of small-team production incidents.
Founders skip the boring parts. Then they page you at 2 AM.
Every incident post-mortem you have ever read reduces to one of ten root causes. Auth token that never expired. A .env committed to git two years ago. A managed DB that had backups nobody ever restored. A rate limit that did not exist. A webhook that trusted its caller. An error nobody was paged about. A page that worked over http and got an ad injected. A form that let anyone post as anyone. A permission check that only ran on the client. A CVE from 2023 in a package nobody had updated.
You do not need a $50,000 security audit to catch any of these. You need a checklist and a Friday afternoon. This tool is that checklist, and the fix plan is written for founders, not for auditors.
The ten categories.
How the grade is calculated.
Every category is weighted 8 to 12 points based on how catastrophic a failure in that area is for a small team. Payment webhooks are weighted more than favicon polish. For each category you pick the tier that best matches your current setup:
| Tier | Score | Meaning |
|---|---|---|
| None | 0.0 x weight | Not done. The failure mode is one bad day away. |
| Basic | 0.4 x weight | Something exists but is fragile or unmonitored. |
| Standard | 0.75 x weight | The correct default is in place (managed provider handles it, or you did it once and it works). |
| Pro | 1.0 x weight | You went further than the default and have verified it works under stress. |
Five steps from signup to fix plan.
Why not just run a security scanner?
Scanners are great when you have a security team and a triage rota. For pre-launch teams with no dedicated security hire, they generate more noise than signal. Every scanner flags every dependency with a public CVE, most of which are not exploitable in your context. You end up with 400 warnings and no clear next action.
The Stack Grader inverts that. It skips the noise, gives you an honest letter grade based on the presence of the correct defaults, and hands back a fix plan you can work in an afternoon. Once you are past this bar, use a scanner (Snyk, Dependabot, GitHub Advanced Security, Semgrep) for the long tail. But do not use them in place of the ten defaults.
What each miss actually costs.
| Category missed | Common consequence | Typical remediation cost |
|---|---|---|
| Payment webhook signatures | Free product for anyone who posts fake “charge succeeded” | Refunds + a weekend of chargeback ops |
| Access control (BOLA) | User A sees user B's data. Twitter dunks incoming. | Public incident report + trust damage |
| Backups (no restore drill) | Backup file exists but restore does not work | Days of lost data + a founder therapy session |
| Rate limiting | One bot exhausts your OTP quota / your OpenAI budget | Hundreds to thousands in unwanted API bill |
| Secrets in the repo | GitHub crawler finds it, exploited within hours | Rotate everything under duress + audit exposure |
| Error monitoring | You learn from users that the checkout is broken | Every hour of lost sales while it burns |
Also useful.
Common questions.
What does "production ready" actually mean for a small team?
It means the app will keep working when real users hit it. That reduces to ten categories in practice: authentication does not leak, secrets are not in the repo, backups are automatic and tested, rate limits exist, payment webhooks are signature-verified, someone gets paged when the app breaks, HTTPS is enforced with HSTS, inputs are validated on the server, access control is tested with a second account, and dependencies have automated updates. Miss any one of these and you have a real incident waiting to happen.
How long does the audit take?
Between 2 and 3 minutes. Ten questions, each with tiered options (None / Basic / Standard / Pro) and a real-world scenario per tier so you pick the one closest to your current setup.
Does the tool scan my code?
No. It is a guided self-assessment, not an automated code scan. That is deliberate. Scanners generate noise, most findings are false positives, and pre-launch teams do not have a security team to triage them. The self-assessment gives you a personalized fix plan focused on the 20 percent of issues that cause 80 percent of small-team incidents.
How is the grade calculated?
Each category is weighted 8 to 12 points. Each tier earns a fraction of the weight: None = 0, Basic = 0.4, Standard = 0.75, Pro = 1.0. Letter grades: A greater or equal 90, B greater or equal 75, C greater or equal 60, D greater or equal 40, F less than 40.
What is in the fix plan for each category?
For every category you scored below Pro on, the plan expands into: why it matters (concrete failure scenario), best practices, common mistakes to avoid, step-by-step how-to, and specific tools by name (Sentry, Better Uptime, Vercel, Auth0, Clerk, Cloudflare, Snyk, Dependabot, etc.). You can track your progress on each fix with an optional status (planning / in progress / done / skipped) plus a notes field and a proof URL.
Is this a replacement for a real security audit?
No. If you handle regulated data (health, finance, defense) or serve enterprise customers with SOC 2 requirements, you still need a real audit. For pre-launch founders, indie hackers, and small teams shipping their first paid feature, this catches the vast majority of issues that would otherwise blow up in production.
Can I re-check my grade over time?
Yes. Any time. Recheck resets your answers and snapshots your previous grade to your history so you can see progress. We can also email you a monthly nudge to recheck if you want to keep the score improving over time.
Can I share my grade card?
Yes. Every grade generates a shareable card (1200x630 PNG) with your letter grade, score, and a link back to the tool. Great for a public commitment ("we are at C, targeting A by end of month") or a private update to a co-founder.
What is the difference between "Standard" and "Pro" for a category?
Standard means you did the boring, correct default (Vercel provisions your SSL, Neon does daily backups, Stripe verifies webhook signatures out of the box if you use their SDK). Pro means you went further: rate limits are per-user AND per-IP with circuit breakers, backups are Point-In-Time Recovery with a monthly restore drill, monitoring pages a human via PagerDuty in under 2 minutes. Standard is fine for most pre-launch teams. Pro is what you should aim for by the time you are handling paid users at scale.
Open the tool.
Ten categories, three minutes, honest letter grade. Come back anytime to re-check as you fix things.
Take the free audit