{"slug": "i-built-a-claude-code-plugin-that-audits-vibe-coded-apps-for-production", "title": "I Built a Claude Code Plugin That Audits Vibe-Coded Apps for Production Readiness", "summary": "A developer known as Taimoorkhan1122 released prod-readiness, a read-only Claude Code plugin that performs whole-repository production-readiness audits of AI-generated \"vibe-coded\" apps. The plugin uses an eight-lens, multi-agent design to flag issues such as broken Supabase RLS policies, committed API keys, untested Stripe webhook handlers, frontend-only auth, and missing rate limiting, writing its findings to a .readiness-audit/ directory. It installs via the Claude Code plugin marketplace and offers a sequential mode for machines that struggle with the full multi-agent run.", "body_md": "Vibe coding got us shipping in hours. Then the launches started breaking.\n\nAI coding assistants are incredible at getting a working prototype on screen. What they're terrible at is the part that comes after: the quiet, boring, unglamorous work of making sure the thing is safe to put in front of real users. I've watched the same failure patterns repeat across AI-generated apps — broken Supabase RLS policies that leak one tenant's data to another, API keys committed straight into the repo, Stripe integrations that handle the happy path and fall over on webhooks and refunds, auth that lives in the frontend while the API trusts everyone, and public endpoints with no rate limiting at all.\n\nThe prototype works. Nobody checked whether it's safe to launch. That's the gap I built **prod-readiness** to fill.\n\nprod-readiness is a Claude Code plugin that runs a read-only, whole-repository production-readiness audit. It answers one question: **is this app safe to launch?**\n\nIt works in three stages:\n\nIt's deliberately read-only. It never touches your code — it produces the audit trail under `.readiness-audit/` and tells you what's wrong and where. There's also an optional local dashboard if you want to watch the audit run in your browser.\n\nKeyword scanners catch secrets in code. They don't catch the structural stuff that actually kills launches: missing recovery paths, unsafe trust boundaries, untested webhook handlers, operational blind spots. The eight-lens design exists because production readiness is a systems question, not a grep question. Each lens looks at the same evidence from a different angle, the way a real review team would.\n\nYou only need Claude Code installed. Three commands:\n\n```\n/plugin marketplace add Taimoorkhan1122/prod-readiness\n/plugin install prod-readiness@prod-readiness-marketplace\n/reload-plugins\n```\n\nThen point it at any repo and run:\n\n```\n/prod-readiness:production-readiness-audit\n```\n\nIf the idea of running a full multi-agent audit makes your laptop fans spin up, there's a sequential mode too:\n\n```\n/prod-readiness:production-readiness-audit sequential\n```\n\nThis is early and I'm actively improving it. If you vibe-code apps — especially ones heading toward real users and real payments — run it and tell me what it missed. The findings that matter most are the ones I haven't thought of yet.\n\nRepo: **[https://github.com/Taimoorkhan1122/prod-readiness](https://github.com/Taimoorkhan1122/prod-readiness)** — stars and issues both welcome.", "url": "https://wpnews.pro/news/i-built-a-claude-code-plugin-that-audits-vibe-coded-apps-for-production", "canonical_source": "https://dev.to/taimoorkhan/i-built-a-claude-code-plugin-that-audits-vibe-coded-apps-for-production-readiness-3797", "published_at": "2026-09-24 10:16:13+00:00", "updated_at": "2026-09-24 10:31:59.696827+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-agents", "ai-products"], "entities": ["Claude Code", "Taimoorkhan1122", "prod-readiness", "Supabase", "Stripe", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/i-built-a-claude-code-plugin-that-audits-vibe-coded-apps-for-production", "markdown": "https://wpnews.pro/news/i-built-a-claude-code-plugin-that-audits-vibe-coded-apps-for-production.md", "text": "https://wpnews.pro/news/i-built-a-claude-code-plugin-that-audits-vibe-coded-apps-for-production.txt", "jsonld": "https://wpnews.pro/news/i-built-a-claude-code-plugin-that-audits-vibe-coded-apps-for-production.jsonld"}}