Cafiyn Pulse
10 categories in 3 minutes

Free production-readiness audit. Honest A-F grade + fix plan.

Ten categories, ten plain-English scenarios, one honest grade. Covers authentication, secrets, backups, rate limiting, payment webhooks, monitoring, HTTPS, input validation, access control, and dependencies. The specific 10 that cause 80 percent of small-team production incidents.

The problem

Founders skip the boring parts. Then they page you at 2 AM.

Every incident post-mortem you have ever read reduces to one of ten root causes. Auth token that never expired. A .env committed to git two years ago. A managed DB that had backups nobody ever restored. A rate limit that did not exist. A webhook that trusted its caller. An error nobody was paged about. A page that worked over http and got an ad injected. A form that let anyone post as anyone. A permission check that only ran on the client. A CVE from 2023 in a package nobody had updated.

You do not need a $50,000 security audit to catch any of these. You need a checklist and a Friday afternoon. This tool is that checklist, and the fix plan is written for founders, not for auditors.

Coverage

The ten categories.

Authentication
Hosted providers (Clerk, Auth0, Supabase Auth), MFA support, SSO if you serve orgs, password reset flow, session expiry that makes sense. The most common failure: no MFA, weak password policy, sessions that never expire.
Secrets management
API keys, DB URLs, and signing secrets live in your host's env var store or a dedicated manager (Doppler, 1Password, Vercel/Render env). Not in the repo. Rotation plan exists. Common failure: committed .env, secrets in Slack DMs, no rotation.
Database backups
Automated daily backups. Point-In-Time Recovery for production. Restore drill actually run at least once. Common failure: managed DB provider has backups but you have never restored one.
Rate limiting
Per-IP AND per-user limits on auth endpoints, expensive endpoints, and analytics endpoints. Circuit breakers on outbound calls. Common failure: no limits, or global limit that a single bad actor exhausts for everyone.
Payment webhooks
Every webhook signature is verified with the provider's signing secret. Idempotency keys on all write operations. Common failure: accepting unsigned webhooks (free products for anyone who guesses the URL), or processing the same webhook twice.
Error monitoring
Sentry / Highlight / Bugsnag installed in prod, source maps uploaded, alerts route to a human within minutes. Common failure: errors going to a Slack channel nobody watches, or console.log-only in prod.
HTTPS and transport security
HTTPS enforced (auto-redirect from http), HSTS header with preload, TLS 1.3 preferred, CSP for XSS protection. Common failure: HTTPS but no HSTS, or over-permissive CSP that lets any script run.
Input validation
Server-side validation with a schema library (Zod, Yup, Joi, Valibot). Never trust the client. File upload types and sizes enforced. Common failure: client-side-only validation, or DB queries with unescaped input.
Access control
Row-level security or an explicit auth check on every read. Tested with a second real account to make sure user A cannot see user B's data. Common failure: broken object-level authorization ("BOLA"), the top web vulnerability by exposure.
Dependencies
Dependabot or Renovate open PRs for updates. Snyk / GitHub Advanced Security enabled. SBOM generated if you sell to enterprise. Common failure: lockfile that has not moved in 8 months, transitive vulnerabilities unpatched for years.
Grade rubric

How the grade is calculated.

Every category is weighted 8 to 12 points based on how catastrophic a failure in that area is for a small team. Payment webhooks are weighted more than favicon polish. For each category you pick the tier that best matches your current setup:

TierScoreMeaning
None0.0 x weightNot done. The failure mode is one bad day away.
Basic0.4 x weightSomething exists but is fragile or unmonitored.
Standard0.75 x weightThe correct default is in place (managed provider handles it, or you did it once and it works).
Pro1.0 x weightYou went further than the default and have verified it works under stress.
A
≥ 90
B
≥ 75
C
≥ 60
D
≥ 40
F
< 40
How it works

Five steps from signup to fix plan.

Step 1
Sign up free (10 sec)
Email + 6-digit code. No card. No password.
Step 2
Answer 10 scenarios
Each scenario has a Basic / Standard / Pro example so you can pick the one closest to your setup.
Step 3
Get your grade
Instant letter grade, radar chart, shareable card (1200x630 PNG).
Step 4
Work the fix plan
Every below-Pro category expands into why, best practices, tools, and step-by-step how-to.
Step 5
Track your progress
Optional: mark each fix as planning / in-progress / done / skipped, add notes and a proof URL, re-check anytime.
Not a scanner

Why not just run a security scanner?

Scanners are great when you have a security team and a triage rota. For pre-launch teams with no dedicated security hire, they generate more noise than signal. Every scanner flags every dependency with a public CVE, most of which are not exploitable in your context. You end up with 400 warnings and no clear next action.

The Stack Grader inverts that. It skips the noise, gives you an honest letter grade based on the presence of the correct defaults, and hands back a fix plan you can work in an afternoon. Once you are past this bar, use a scanner (Snyk, Dependabot, GitHub Advanced Security, Semgrep) for the long tail. But do not use them in place of the ten defaults.

Real cost of skipping

What each miss actually costs.

Category missedCommon consequenceTypical remediation cost
Payment webhook signaturesFree product for anyone who posts fake “charge succeeded”Refunds + a weekend of chargeback ops
Access control (BOLA)User A sees user B's data. Twitter dunks incoming.Public incident report + trust damage
Backups (no restore drill)Backup file exists but restore does not workDays of lost data + a founder therapy session
Rate limitingOne bot exhausts your OTP quota / your OpenAI budgetHundreds to thousands in unwanted API bill
Secrets in the repoGitHub crawler finds it, exploited within hoursRotate everything under duress + audit exposure
Error monitoringYou learn from users that the checkout is brokenEvery hour of lost sales while it burns
Related
FAQ

Common questions.

What does "production ready" actually mean for a small team?

It means the app will keep working when real users hit it. That reduces to ten categories in practice: authentication does not leak, secrets are not in the repo, backups are automatic and tested, rate limits exist, payment webhooks are signature-verified, someone gets paged when the app breaks, HTTPS is enforced with HSTS, inputs are validated on the server, access control is tested with a second account, and dependencies have automated updates. Miss any one of these and you have a real incident waiting to happen.

How long does the audit take?

Between 2 and 3 minutes. Ten questions, each with tiered options (None / Basic / Standard / Pro) and a real-world scenario per tier so you pick the one closest to your current setup.

Does the tool scan my code?

No. It is a guided self-assessment, not an automated code scan. That is deliberate. Scanners generate noise, most findings are false positives, and pre-launch teams do not have a security team to triage them. The self-assessment gives you a personalized fix plan focused on the 20 percent of issues that cause 80 percent of small-team incidents.

How is the grade calculated?

Each category is weighted 8 to 12 points. Each tier earns a fraction of the weight: None = 0, Basic = 0.4, Standard = 0.75, Pro = 1.0. Letter grades: A greater or equal 90, B greater or equal 75, C greater or equal 60, D greater or equal 40, F less than 40.

What is in the fix plan for each category?

For every category you scored below Pro on, the plan expands into: why it matters (concrete failure scenario), best practices, common mistakes to avoid, step-by-step how-to, and specific tools by name (Sentry, Better Uptime, Vercel, Auth0, Clerk, Cloudflare, Snyk, Dependabot, etc.). You can track your progress on each fix with an optional status (planning / in progress / done / skipped) plus a notes field and a proof URL.

Is this a replacement for a real security audit?

No. If you handle regulated data (health, finance, defense) or serve enterprise customers with SOC 2 requirements, you still need a real audit. For pre-launch founders, indie hackers, and small teams shipping their first paid feature, this catches the vast majority of issues that would otherwise blow up in production.

Can I re-check my grade over time?

Yes. Any time. Recheck resets your answers and snapshots your previous grade to your history so you can see progress. We can also email you a monthly nudge to recheck if you want to keep the score improving over time.

Can I share my grade card?

Yes. Every grade generates a shareable card (1200x630 PNG) with your letter grade, score, and a link back to the tool. Great for a public commitment ("we are at C, targeting A by end of month") or a private update to a co-founder.

What is the difference between "Standard" and "Pro" for a category?

Standard means you did the boring, correct default (Vercel provisions your SSL, Neon does daily backups, Stripe verifies webhook signatures out of the box if you use their SDK). Pro means you went further: rate limits are per-user AND per-IP with circuit breakers, backups are Point-In-Time Recovery with a monthly restore drill, monitoring pages a human via PagerDuty in under 2 minutes. Standard is fine for most pre-launch teams. Pro is what you should aim for by the time you are handling paid users at scale.

Open the tool.

Ten categories, three minutes, honest letter grade. Come back anytime to re-check as you fix things.

Take the free audit