checkyourself

Production-readiness diagnostics and guided remediation for AI-built apps using CheckYourself. Use when the user asks for a pre-launch audit, production readiness score, evidence-backed findings register, safest first fix batch, learning plan, optional dashboard, or a read-only reality check before shipping a repository, app, website, agent, MCP server, or AI-generated project.

Use this capability whenever the user asks for a production-ready plan, full-stack review, hardening audit, launch checklist, architecture critique, or multi-layer implementation. Trigger even when the user only says “make it production ready”, “ship this”, “harden it”, “review this stack”, or “what am I missing”.

Use this capability when defining, refining, or reviewing a feature before implementation. Trigger on requirements, user stories, acceptance criteria, OpenAPI, AsyncAPI, JSON Schema, contracts, ADRs, RFCs, roadmap items, or “turn this idea into buildable work”.

Use this capability for UI architecture, frontend performance, accessibility, routing guards, forms, client state, design-system integration, browser security boundaries, and user-facing AI interfaces. Trigger on React, Vue, Angular, Svelte, components, UI, a11y, WCAG, Core Web Vitals, forms, routing, lazy loading, bundle size, hydration, or client errors.

Use this capability for REST, GraphQL, gRPC, webhooks, background jobs, service-layer design, middleware, validation, idempotency, pagination, API versioning, error handling, and backend business rules. Trigger on API, endpoint, controller, service, webhook, job, queue, validation, middleware, status code, OpenAPI, GraphQL, gRPC, or business logic.

Use this capability for database schema design, SQL/NoSQL selection, migrations, indexing, query review, connection pooling, backups, object storage, event storage, data retention, and data lifecycle planning. Trigger on database, schema, migration, index, SQL, PostgreSQL, MySQL, MongoDB, Redis, S3, ORM, transaction, backup, retention, or data model.

Use this capability for login, signup, session management, OAuth/OIDC, SSO, JWT, cookies, MFA, RBAC, ABAC, ReBAC, permission checks, service identities, and access reviews. Trigger on auth, login, signup, token, JWT, OAuth, OIDC, SSO, session, cookie, role, permission, MFA, 2FA, tenant access, or service account.

Use this capability whenever multi-tenancy, tenant isolation, Row-Level Security, shared-schema SaaS, organization-scoped data, tenant_id, database policies, cross-tenant access, or tenant-aware caching appears. Trigger even if the user only says “orgs”, “workspaces”, “teams”, “customers”, or “B2B SaaS”.

Use this capability for threat modeling, secure code review, OWASP risk review, API abuse, input/output validation, injection, XSS, CSRF, SSRF, deserialization, security headers, encryption, secrets exposure, audit logging, privacy-by-design, or security acceptance gates.

Use this capability for environment variables, config schemas, secrets, key rotation, feature flags, runtime toggles, service discovery, dotenv cleanup, secret scanning, config drift, and environment parity. Trigger on env, config, secret, API key, credentials, feature flag, toggle, runtime, staging, production config, or rotation.

Use this capability for test plans, unit/integration/e2e tests, contract tests, property tests, snapshot strategy, mocks, test data, coverage, flaky tests, regression suites, quality gates, AI evals, and release verification. Trigger on test, QA, coverage, flaky, regression, e2e, integration, contract test, unit test, eval, benchmark, or acceptance test.

Use this capability for Git workflow, pull request policy, branch protection, CI/CD, build pipelines, release automation, dependency management, SBOM, provenance, SLSA, signing, container scanning, lockfiles, and supply-chain security. Trigger on CI, CD, pipeline, Git, branch, PR, release, dependency, SBOM, provenance, SLSA, signing, artifact, container scan, or versioning.

Use this capability for hosting decisions, platform selection, container deployment, serverless deployment, domains, DNS, TLS, staging/production environments, blue-green, canary, rolling deploys, migrations during deploy, health checks, smoke tests, and rollback plans.

Use this capability for cloud architecture, IaC, Terraform/OpenTofu/Pulumi, Kubernetes, networking, VPC/VNet, IAM, compute, storage, managed databases, queues, cost controls, policy-as-code, drift detection, and infrastructure review.

Use this capability for performance optimization, load tests, k6/JMeter/Locust plans, caching, Redis, CDN, Cache-Control, invalidation, rate limiting, quotas, token bucket, sliding window, 429 behavior, abuse protection, and cost-based throttling.

Use this capability for load balancing, autoscaling, horizontal scaling, capacity planning, queues, workers, circuit breakers, retries, timeouts, backpressure, bulkheads, thundering herd control, graceful degradation, chaos testing, and resilience patterns.

Use this capability for logging, metrics, traces, OpenTelemetry, error tracking, correlation IDs, dashboards, alerts, SLO burn alerts, runbooks, incident triage, root-cause analysis, postmortems, and on-call readiness.

Use this capability for availability targets, SLAs, SLOs, SLIs, error budgets, backups, restores, RTO, RPO, failover, multi-region, DR, business continuity, recovery runbooks, chaos/game days, and resilience evidence.

Use this capability for AI features, RAG, citations, model-agnostic prompts, evals, hallucination reduction, prompt injection, tool use, agent sandboxes, policy gates, audit trails, autonomy levels, human approval, and AI-assisted coding governance.

Use this capability for PII, PHI, PCI, GDPR/CCPA-style obligations, consent, retention, deletion, DSAR/export, data classification, data residency, audit evidence, compliance controls, records of processing, and privacy-by-design reviews.