{"id":51223005,"url":"https://github.com/apoorvjain25/production-audit","last_synced_at":"2026-07-16T19:00:56.566Z","repository":{"id":364301481,"uuid":"1267319628","full_name":"apoorvjain25/production-audit","owner":"apoorvjain25","description":"Claude Code skill that audits your product until it stops finding things - then proves it. 24 lenses, 2 convergence loops, 0 hedging.","archived":false,"fork":false,"pushed_at":"2026-06-25T08:30:20.000Z","size":2134,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-25T10:15:26.499Z","etag":null,"topics":["ai-agents","anthropic","claude","claude-code","claude-skills","code-audit","code-review","developer-tools","llm","loop-engineering","production-readiness"],"latest_commit_sha":null,"homepage":"https://pulsehq.tech","language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/apoorvjain25.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-12T12:35:49.000Z","updated_at":"2026-06-25T08:29:45.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/apoorvjain25/production-audit","commit_stats":null,"previous_names":["apoorvjain25/production-audit"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/apoorvjain25/production-audit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/apoorvjain25%2Fproduction-audit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/apoorvjain25%2Fproduction-audit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/apoorvjain25%2Fproduction-audit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/apoorvjain25%2Fproduction-audit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/apoorvjain25","download_url":"https://codeload.github.com/apoorvjain25/production-audit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/apoorvjain25%2Fproduction-audit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35555509,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-16T02:00:06.687Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-agents","anthropic","claude","claude-code","claude-skills","code-audit","code-review","developer-tools","llm","loop-engineering","production-readiness"],"created_at":"2026-06-28T09:00:31.116Z","updated_at":"2026-07-16T19:00:56.559Z","avatar_url":"https://github.com/apoorvjain25.png","language":null,"funding_links":[],"categories":["Source Catalog"],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n\u003cimg src=\"assets/hero.png\" alt=\"production-audit: the Claude Code skill that audits your product until it stops finding things, then proves it\" width=\"100%\"\u003e\n\n# 🔍 production-audit\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)\n[![Claude Code Skill](https://img.shields.io/badge/Claude%20Code-skill-d97757.svg)](https://docs.claude.com/en/docs/claude-code)\n[![Audit lenses](https://img.shields.io/badge/audit%20lenses-24-blue.svg)](production-audit/references/audit-angles.md)\n[![Defect classes](https://img.shields.io/badge/defect%20classes-18-blueviolet.svg)](production-audit/references/finding-taxonomy.md)\n[![Works everywhere](https://img.shields.io/badge/also%20runs%20in-Cursor%20·%20Windsurf%20·%20Copilot%20·%20aider-8A2BE2.svg)](PROMPT.md)\n\n```\n/production-audit\n```\n\n\u003c/div\u003e\n\nMost \"audit my code\" prompts do one pass, find 15 issues, and write you a reassuring summary. This skill found **1,200+ real findings** on a production B2B SaaS, then took **14 verification passes** after the fixes before it could honestly say \"done.\"\n\n## How it works\n\n```mermaid\nflowchart TD\n    P0[\"Phase 0: Inventory\u003cbr/\u003eevery page, claim, endpoint, job,\u003cbr/\u003eprompt, icon, email, locale\"]\n    P0 --\u003e LENS[\"Pick a lens never used before\u003cbr/\u003e(24 in the catalog)\"]\n    LENS --\u003e SWEEP[\"Sweep the whole inventory through it\"]\n    SWEEP --\u003e VERIFY[\"Verify every candidate finding\u003cbr/\u003eagainst the real code: trace the guard,\u003cbr/\u003erun the test that settles it\"]\n    VERIFY --\u003e Q1{\"Two consecutive passes\u003cbr/\u003ewith nothing new?\"}\n    Q1 -- \"no\" --\u003e LENS\n    Q1 -- \"yes\" --\u003e REPORT[\"The report: one flat list\u003cbr/\u003e[SEVERITY] [AREA] file:line - defect - fix\"]\n    REPORT -. \"fix mode\" .-\u003e WAVE[\"Fix waves\u003cbr/\u003eCRITICAL+HIGH → MEDIUM → LOW\"]\n    WAVE --\u003e GATE[\"Gate: build + typecheck + lint + tests\u003cbr/\u003ethen over-reach review\"]\n    GATE --\u003e REAUDIT[\"Re-audit with fresh lenses\u003cbr/\u003e(regression, fix-completeness, over-reach)\"]\n    REAUDIT --\u003e Q2{\"Two consecutive passes with\u003cbr/\u003ezero CRITICAL / zero HIGH?\"}\n    Q2 -- \"no: fix and go again\" --\u003e WAVE\n    Q2 -- \"yes\" --\u003e DONE[\"Converged. Done, with proof.\"]\n```\n\nThe skill inventories every surface your product has (pages, routes, claims, jobs, prompts, icons, emails, locales), then sweeps that inventory through **24 different audit lenses**, one lens per pass. Discovery stops only when **two consecutive passes find nothing new**. In fix mode, a second loop runs after the fixes until **two consecutive passes find zero CRITICAL/HIGH**. \"We checked\" becomes \"we converged.\"\n\n## Why convergence beats a checklist\n\n|  | A one-shot \"audit my code\" prompt | `production-audit` |\n|---|---|---|\n| **Passes** | one | as many as it takes; stops after 2 consecutive quiet passes |\n| **Framing** | whatever the prompt happens to emphasize | 24 deliberately diverse lenses, never repeated |\n| **False positives** | reported confidently | every finding verified against the real code before it's reported |\n| **Marketing claims** | ignored | every specific public promise verified or flagged |\n| **Output** | summary + a few highlights | flat list, every row pinned to `file:line` |\n| **\"Done\" means** | the context window filled up | convergence, proven twice over |\n\n## How it compares to other audit tools\n\nMulti-lens auditing and convergence-style stopping aren't unique to this skill. [RepoLens](https://github.com/TheMorpheus407/RepoLens), CheckLoop, and audit-loop all do versions of them, and Anthropic ships a built-in `/security-review`. What this skill adds is two things none of them do by default: it verifies your **public claims against the code**, and it **verifies every finding by default** (not as an opt-in flag) before reporting it.\n\n| | production-audit | RepoLens / audit-loop | `/security-review` |\n|---|---|---|---|\n| Multiple audit lenses | ✅ 24 | ✅ (RepoLens: many) | one (security) |\n| Convergence / self-terminating loop | ✅ (capped heuristic) | ✅ | single pass |\n| Claim-vs-code (marketing/docs vs implementation) | ✅ | ✗ | ✗ |\n| Per-finding verification | ✅ default-on | RepoLens: opt-in, off by default | ✅ |\n| Whole-repo (not just the diff) | ✅ | ✅ | diff-focused |\n| Output | flat `file:line` list, no summary | varies | inline PR comments |\n\nWe didn't invent multi-lens or convergence. The edge is claim-vs-code plus verification-by-default.\n\n## What a finding looks like\n\nNo executive summary. No \"overall, the codebase is in good shape.\" Every row is pinned and actionable:\n\n```\n[CRITICAL] [SECURITY] src/lib/cache.ts:21 - dashboard cache key omits the workspace id; one tenant's data served to another - add the tenant to the key\n[CRITICAL] [AUTH] src/api/admin/users.ts:9 - admin role checked only in the UI; the endpoint returns every user to any session - enforce the role server-side\n[HIGH] [DATA] src/import/processor.ts:142 - document row committed before its permission row, non-atomically; content is live and unprotected in the gap - one transaction, permission first\n[HIGH] [CONTENT] landing/security.html §hero - claims \"AES-256 encryption at rest\"; no encryption configured anywhere in the storage layer - implement it or remove the claim\n[HIGH] [AI] src/prompts/extract.ts:18 - prompt asks for prose but the parser JSON.parses the reply; every extraction silently yields [] - demand JSON, validate, surface failures\n[HIGH] [RELIABILITY] src/realtime/hub.ts:33 - per-connection handlers never unsubscribed on disconnect; memory grows with every connect cycle - clean up in the close handler\n[MEDIUM] [PERF] src/dashboard/page.tsx:61 - members fetched per project in a loop (N+1, ~40 queries per load) - one grouped query\n[LOW] [CONTENT] pricing.html §faq - \"recieve\" twice; failed-payment state renders raw \"Error: ECONNREFUSED\" - fix the copy, map errors to human text\n```\n\nRules the skill enforces on itself: every row has `file:line` or `URL + selector` (no location means dropped), no \"consider/might/could\", no padding, and an honest `TRUNCATED AT ...` line if it runs out of context instead of a fake wrap-up.\n\nWant more? See the **[sample report](examples/sample-report.md)**: 30 anonymized rows from the real 1,200-finding run, plus both convergence ledgers.\n\n## The 24 lenses\n\nEach discovery pass takes exactly one lens and sweeps the entire inventory through it; the diversity is what makes \"we found everything\" credible. Full catalog with a real example finding per lens in [audit-angles.md](production-audit/references/audit-angles.md).\n\n| # | Lens | What it makes visible |\n|---|------|----------------------|\n| 1 | Subsystem sweep | one subsystem traced end to end; builds the map the other lenses need |\n| 2 | Attack-class | IDOR, cross-tenant leaks, injection, exposed secrets, unverified webhooks |\n| 3 | Claim-vs-code | every public promise traced to the code that delivers it |\n| 4 | Data-shape | zero / one / huge / unicode / 100k-row data through every flow |\n| 5 | Platform divergence \u0026 responsiveness | web vs mobile vs CLI vs API parity; every page at every width |\n| 6 | Lifecycle | signup → daily use → offboarding → deletion; do retention promises hold? |\n| 7 | Write-path integrity | idempotency; non-atomic sibling writes (record live before its permission row) |\n| 8 | Failure-mode | every dependency down, slow, or returning garbage |\n| 9 | Dead-and-stale | docs for removed features, shipping TODOs, flags off with live marketing |\n| 10 | Gate-run \u0026 gate-escape | actually run build/typecheck/lint/tests, then hunt what slips past them |\n| 11 | Perf | N+1, missing indexes, Core Web Vitals, unoptimized images, uncapped calls |\n| 12 | A11y \u0026 UX-jank | focus, ARIA, contrast, broken animations, spinners with no failure path |\n| 13 | Content \u0026 copy | typos, placeholder text, jargon, stack traces rendered to users |\n| 14 | Asset \u0026 icon integrity | broken images, mixed icon sets, missing favicons, fonts that never load |\n| 15 | Connection \u0026 wiring | dead endpoints, hardcoded staging URLs, DB pool leaks, test keys in prod |\n| 16 | LLM \u0026 prompt quality | prompts contradicting their parsers, unvalidated output, uncapped spend |\n| 17 | Auth \u0026 permissions deep-dive | the full role x action matrix, sessions, tokens, resets, MFA, stale grants |\n| 18 | Resource leaks \u0026 long-running drift | what grows with uptime: listeners, caches, handles, temp files |\n| 19 | Observability \u0026 operations | could the team even tell it's broken? swallowed errors, no alerts, no logs |\n| 20 | Abuse \u0026 limits | what a hostile user can do unboundedly: rate limits, quotas, spam vectors |\n| 21 | Config \u0026 environment | env vars unvalidated at boot, dev defaults in prod, drifted configs |\n| 22 | Dependency \u0026 supply-chain | CVEs in the lockfile, abandoned packages, license conflicts |\n| 23 | Caching correctness | keys missing tenant scope, stale after writes, auth cached past revocation |\n| 24 | Concurrency \u0026 races | double-submit, two tabs, two workers on one job, check-then-act gaps |\n\nPlus three verification-only lenses for after the fixes: **regression**, **fix-completeness** (the same mistake is almost never made once), and **over-reach**.\n\n## The kinds of bugs it catches that tests don't\n\nFrom real runs:\n\n- **Non-atomic sibling writes**: a record persisted *before* its permission row, leaving a window where private content was retrievable workspace-wide. Invisible to tests; found by the write-path-integrity lens.\n- **Gate-escapes**: type errors in generated code that passed both the typechecker (runs before generation) and the build (configured to ignore errors). Found by auditing the gates themselves.\n- **Flagged-but-broken state**: records marked searchable whose index entry was deleted and never rebuilt: present in every count, absent from every search.\n- **Promises with no code**: security-page claims with zero implementing lines.\n\n## Install\n\n**Claude Code (easiest)**: install as a plugin.\n\n```\n/plugin marketplace add apoorvjain25/production-audit\n/plugin install production-audit@apoorvjain25\n```\n\n**Claude Code (manual)**: copy the skill folder.\n\n```bash\ngit clone https://github.com/apoorvjain25/production-audit.git\n# personal (all projects)\ncp -r production-audit/production-audit ~/.claude/skills/\n# or per-project (shared with your team via the repo)\ncp -r production-audit/production-audit your-project/.claude/skills/\n```\n\n**Everything else** (Cursor, Windsurf, Copilot, aider, raw API): paste [PROMPT.md](PROMPT.md). Same methodology, single file, zero install.\n\n## Use\n\n| Command | What you get |\n|---------|--------------|\n| `/production-audit` | full product audit, discovery only; nothing is modified |\n| `/production-audit fix` | audit → fix in severity waves → verification loop until 2 clean passes |\n| `/production-audit security` | one lens family at full depth |\n| `/production-audit src/billing` | one subsystem through all 24 lenses |\n| `/production-audit docs-vs-code` | every public claim verified against the implementation |\n\nWorks on any stack: web app, API, CLI, mobile, monorepo. The skill builds its inventory from *your* product's surfaces before it audits, so nothing is assumed about your architecture.\n\n\u003e **Heads up:** the full pipeline is thorough by design. Discovery on a real product produces hundreds of rows, and `fix` mode will happily run 10+ verification rounds. Scope it if you want a quick pass.\n\n**Suppressing known false positives:** drop a `.audit-ignore` file at your repo root and future runs will skip findings you've already triaged. One entry per line, `path:line  issue-tag  # reason`, and the reason is required. The audit only reads this file; it never writes to it, so it can't quietly hide a real bug from you.\n\n## Reading the report\n\n| Tag | Means | Example |\n|-----|-------|---------|\n| `CRITICAL` | data loss, breach reachable today, broken core flow, crash on a primary path | cross-tenant cache leak |\n| `HIGH` | claimed feature broken/missing, security weakness one precondition away, silent failure | payment-webhook failures swallowed |\n| `MEDIUM` | degraded behavior, edge-case failure, real inconsistency | chart crashes on an empty dataset |\n| `LOW` | minor bug, cosmetic defect, polish | missing favicon |\n| `IMPROVEMENT` | a concrete, named upgrade, still no hedging | atomic decrement instead of check-then-act |\n\nRows are ordered CRITICAL → IMPROVEMENT and grouped by area (`SECURITY`, `AUTH`, `DATA`, `PERF`, `CONTENT`, ...) within each severity, so a team can fix top-down, row by row.\n\n## Limitations\n\nWorth knowing before you rely on it:\n\n- **Source-only.** It reads your code, config, and docs. It does not analyze binaries or containers, and supply-chain coverage stops at what the lockfile reveals.\n- **Not deterministic.** Two runs can surface different findings and stop at different points. It's an audit aid, not a reproducible compliance gate.\n- **Cost and time scale with the repo.** A full converged run on a large product takes hours and real token spend. Scope it when you don't need the whole thing.\n- **Convergence bounds, it doesn't prove.** Two quiet passes mean these 24 angles stopped finding things, not that nothing remains. It's a strong \"we looked hard enough\" heuristic with a cap, not a guarantee.\n\n## What's in the box\n\n```\nproduction-audit/\n├── SKILL.md                        # the skill: process, format, rules\n└── references/\n    ├── audit-angles.md             # 24 discovery lenses, each with a real example finding\n    └── finding-taxonomy.md         # 18 defect classes + severity rubric + borderline calls\n.claude-plugin/                     # plugin + marketplace manifests (for /plugin install)\nexamples/\n└── sample-report.md                # 30 anonymized rows + both convergence ledgers\nPROMPT.md                           # the whole methodology in one paste-able file\nCHANGELOG.md                        # version history\n```\n\n## FAQ\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eHow long does a full run take?\u003c/b\u003e\u003c/summary\u003e\n\nHours, not minutes. That's the point. Discovery on a real product produces hundreds of rows across many passes, and `fix` mode routinely runs 10+ verification rounds. For a quick pass, scope it: `/production-audit src/billing` or `/production-audit security`.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eWill it change my code?\u003c/b\u003e\u003c/summary\u003e\n\nNot unless you ask. The default run is discovery only: read everything, modify nothing. `fix` mode does edit, but every wave is gated on a green build + typecheck + lint + tests, and an over-reach review reverts any change that went beyond its finding.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eWhat about false positives?\u003c/b\u003e\u003c/summary\u003e\n\nEvery candidate finding is verified against the real code before it's reported: is there a guard upstream? Is the check enforced elsewhere? Is that dead code actually unreachable? Does the test pass? Findings that can't be pinned to a `file:line` or `URL + selector` are dropped. The verification is evidence-gathering, not an attempt to argue the finding away (a located, uncleared security risk is reported, not dismissed), so the list stays both trustworthy and honest about what it can't fully rule out.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eWhy is there no executive summary?\u003c/b\u003e\u003c/summary\u003e\n\nSummaries are where audits go to soften. \"Overall the codebase is in good shape\" tells you nothing actionable and quietly buries the rows that matter. Every row in this report stands alone (severity, location, defect, fix), so the list itself is the deliverable.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eMy product isn't a web app. Does this still work?\u003c/b\u003e\u003c/summary\u003e\n\nYes. Phase 0 builds the inventory from whatever surfaces *your* product actually has: CLI commands, API endpoints, mobile screens, background jobs, docs. Lenses that don't apply (e.g. LLM quality with no LLM features) are skipped; everything else runs at full depth.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eWhat's the difference between SKILL.md and PROMPT.md?\u003c/b\u003e\u003c/summary\u003e\n\nSame methodology, two packagings. \u003ccode\u003eproduction-audit/SKILL.md\u003c/code\u003e + its references install as a Claude Code skill, with the lens catalog and taxonomy loaded on demand. \u003ccode\u003ePROMPT.md\u003c/code\u003e is the whole thing flattened into one file you can paste into any other agent.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cb\u003eHow do I know it actually converged instead of just stopping?\u003c/b\u003e\u003c/summary\u003e\n\nThe skill keeps a pass ledger (pass number, lens used, new findings count) and is only allowed to stop when two consecutive passes from \u003ci\u003edifferent\u003c/i\u003e lenses add zero new rows. Ten quiet sweeps of the same lens count as one angle, not ten. After fixes, the bar is two consecutive passes with zero CRITICAL/HIGH. To be precise about the claim: convergence is a strong \"we looked hard enough\" heuristic with a hard pass cap, not a mathematical proof that nothing remains (see \u003ca href=\"#limitations\"\u003eLimitations\u003c/a\u003e).\n\u003c/details\u003e\n\n## Philosophy\n\n\u003e Trust what the code does, not what it's called.\n\u003e A short list means you didn't look hard enough.\n\u003e One quiet pass is not convergence.\n\n## Origin\n\nThis skill was extracted from a real pre-launch audit of [Pulse](https://pulsehq.tech?utm_source=github\u0026utm_medium=production-audit), a company brain built for the agent era. The 1,200-finding run this README opens with was our own codebase. We ran the loop until it converged, then open-sourced the methodology.\n\n## Contributing\n\nFound a defect class the taxonomy misses, or a lens that would have caught a bug in your product? PRs welcome: add the lens to [audit-angles.md](production-audit/references/audit-angles.md) with a one-line example finding, and keep [PROMPT.md](PROMPT.md) in sync.\n\n## License\n\nMIT. Use it, fork it, ship it.\n\n---\n\n*If this skill finds something scary in your codebase, that's the skill working. ⭐ the repo and tell someone what it caught.*\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapoorvjain25%2Fproduction-audit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fapoorvjain25%2Fproduction-audit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fapoorvjain25%2Fproduction-audit/lists"}