For Claude Code and Cursor users

All tests green. Has a single one tried to open /admin while logged out?

You built something people use, and the test suite is green. The question is what green is measuring. If no test calls a protected route as nobody, or as the wrong user, a change that removes a permission check passes every one of them.

Run the free check

  1. 1 · How it happens

    Tests describe the path someone had in mind.

    When your agent writes a feature and its tests in the same session, the tests check what it meant to build: the right user, valid input, the happy ending. A test that calls the admin route with no session and expects a 401, or signs in as another customer and expects a 403, is the one nobody asked for. And a test once marked .skip to get a build through, or left on .only, means part of the suite never runs while the result stays green.

  2. 2 · What it costs

    A missing check ships green.

    Whoever drops a role check in a refactor, you or your agent, sees every test pass. The route now answers anyone who calls it. Nothing fails in CI, nothing fails in the deploy, and the regression is found by whoever tries the URL they should not have.

  3. 3 · Why you haven't seen it

    Green looks the same either way.

    A suite of fifty happy-path tests and a suite that also tries the wrong user print the same green line. The number of tests says how much was written, not what was tried. Unless you read every test file, you cannot tell which kind you have.

What the free check shows you

Findings like these, for every gap in your app: how serious it is, what is wrong, where it is, and what it costs you if it stays.

prodready · free checkexample · not your app
highTesting

3 of 27 test files assert anything about unauthorised, forbidden or invalid requests; the suite tests the path where everything goes right.

The paths that carry the security guarantee are the untested ones, so a refactor that drops a role check passes every test and ships green, and the regression is only ever found by whoever tries the URL they should not have.

Evidencetests/

mediumTesting

3 tests are disabled or focused in merged code (tests/billing.test.ts, tests/auth.test.ts).

The suite reports green while the cases most likely to matter never execute: a focused run silently skips everything else, and a skipped test is usually the one that was failing for a real reason nobody had time to chase.

Evidencetests/billing.test.ts:41

Your report names your own tables, files and lines, with a score for the whole app.

See a full sample report →

Run the free check tonight.

It runs in your coding tool, on your machine, in a few minutes. What reaches us: counts, rule names and file paths with line numbers. Never your source, your data or a secret value. Your report page is kept 7 days behind an access code. Exactly what it runs →

On your laptop · freeabout two minutes

Add it, sign in, ask.

claude mcp add --transport http prodready https://mcp.prodready.si/mcp --scope user
  1. Add it. Run it in a terminal.
  2. Sign in. In Claude Code type /mcp, pick prodready, choose Authenticate. A browser page asks for your email; type the 6-digit code we send (or click its link), then approve. No password, no card.
  3. Ask. Type “check my app”.
On your phone?no coding tool here

Send it to your laptop.

The check runs in the coding tool on your computer. We email you the one line to paste, and nothing else unless you ask.

Built in Lovable, Replit or Base44, with no coding tool on your laptop? Connect the project to GitHub, open that folder in Claude Code or Cursor, then add the line above. The step-by-step guide →

See a full sample report →

After the report: when you want the gaps closed the way serious software teams close them, the same prodready connection runs the SDLC on your project. How that works →