Production Foundation
Protects the systems that must not fail in production: authentication, billing, admin access, environment safety, and deployment configuration.
What It Protects
AI tools generate code for the happy path. They build login forms, checkout flows, and admin panels that work in development. But they skip the safety checks that matter in production: Is the session verified server-side? Is the webhook signature checked? Can any user access admin routes by guessing the URL?
Production Foundation defines what "safe" means for these critical systems.
What Typically Breaks
Auth failures expose user data
Missing RLS policies, client-side-only auth checks, service_role key in client code. These gaps are invisible until exploited.
Billing failures cause revenue loss
Unverified webhooks, client-side checkout, fulfillment on success_url. These failures only show up in the bank account.
Admin failures enable privilege escalation
Unprotected admin routes, hardcoded credentials, exposed debug endpoints. Any user can access admin functions.
Foundation gaps create deployment failures
Missing .env.example, committed secrets, no TypeScript strict mode, no error boundary.
Phase 1 Checks
24 automated checks across four modules. Each has a defined threat thesis and binary PASS/FAIL result.
Auth Safety (8 checks)
Billing Safety (8 checks)
Admin Safety (4 checks)
Foundation Safety (4 checks)
Relationship to Trust Score
Trust Score is the primary metric for Production Foundation. It measures how many safety checks the app passes.
| Grade | Score | Meaning |
|---|---|---|
| A | 90–100 | Low risk — no critical gaps in covered scope |
| B | 80–89 | Moderate risk — minor gaps, fix before scaling |
| C | 70–79 | Elevated risk — significant gaps in 1+ modules |
| D | 55–69 | High risk — critical issues found |
| F | 0–54 | Critical risk — major gaps across modules |
Trust Score is a point-in-time assessment. It is not a certification, security audit, or guarantee of production safety.
What This Layer Does Not Cover
- Business logic correctness (Business Logic Protection)
- Architecture structure and boundaries (Slice Architecture)
- Runtime behavior, performance, or availability
- Compliance determinations (SOC2, HIPAA, PCI DSS)