“Make this production ready” is kind of a terrible prompt. What does that actually mean? Security? Auth? Dead code? Tests? Deployment? Backups? Privacy policy? Rate limits? Dependency vulnerabilities? Half-finished features? Whether the branch should even be merged? I kept ending up with giant prompt chains after Claude finished building something, so I turned the checklist into an open-source Claude Code skill: Launchify The idea is that instead of trusting: “looks good, tests pass” you can run: /launchify-landify and have the agent systematically go through: security → cleanup → feature completeness → compliance → verification → production grade The security side alone covers 24 areas including auth/authz, APIs, databases, web vulns, CI/CD, cloud, dependencies, LLMs, RAG, AI agents, payments, business logic, privacy, reliability, etc. I also recently did a gap analysis against OWASP/API/LLM/NIST guidance and added another 238 checks for things like: SLSA/Sigstore/SBOM provenance SSRF through AI web tools excessive agent permissions package install-script risks Kubernetes/container hardening Stripe/PayPal/Square webhook verification TOCTOU/distributed locking RTO/RPO + immutable backups SIEM/IoC monitoring KMS/key rotation Then I realized “production ready” isn’t only code. So Launchify now also checks whether an actual product is missing things like: privacy policy, ToS, cookie consent, DPA, DMCA, accessibility, AI disclosures, refund policy, SLA, and relevant regulatory requirements. There are audit-only versions too, so you can have Claude inspect everything without modifying the repo. It’s now 60 commands / 25 categories , and I added a global install so Launchify can live in ~/.launchify/ and work across projects instead of having to copy the spec into every repo. The part I care most about is making the agent prove findings through actual code paths instead of seeing a scary keyword and declaring a vulnerability. MIT / open source: https://github.com/jacobpowaza/launchify-skills For people who use Claude Code on real projects: what’s the thing Claude most often says is “done” that you still don’t trust until you check it yourself? That’s basically the list I’m trying to eliminate. submitted by /u/jacobpowaza
Originally posted by u/jacobpowaza on r/ClaudeCode