TPRS-0.1
Your app works. Is it ready for real users?
If you built your application with an AI assistant, it probably does what you asked. Production asks for more: security, reliability, maintainability, ownership of the data you hold. Trustack analyses your repository and tells you — in plain language, with evidence — exactly what stands between it and real users.
Read-only access · Your code is never stored · Result in minutes
- 37
- controls evaluated
- 6
- areas of readiness
- 0
- invented findings
- 100
- point readiness score
AI writes the code you asked for. Not the code you forgot to ask for.
An assistant builds features. It does not decide that your database needs backups, that your keys should never sit in the repository, or that the library it installed has a published vulnerability. These gaps are invisible in the browser — they only show up the day something goes wrong.
Secrets committed to the repository
API keys, database passwords and tokens pasted straight into the code. It works — until the repository becomes public, or a collaborator leaves.
Libraries with known vulnerabilities
Your app pulls in hundreds of third-party packages. Some of them have published security advisories. Nobody told you.
No backup, no restore, no monitoring
The app runs fine today. There is no plan for the day it doesn't, and no way to know something went wrong before your users tell you.
Data you didn't realise you were responsible for
Personal data collected, stored and never classified. That is a legal exposure long before it becomes a technical one.
How it works
Connect your repository
A read-only GitHub token, encrypted on our side. We never write to your code and never store it — the analysis runs in memory and the copy is discarded.
We analyse the real code
Secrets, dangerous patterns, dependencies and their known vulnerabilities, configuration, containers, CI, documentation, tests. No guesses, no invented findings.
You get a verdict you can act on
A score out of 100, the blocking problems first, and for every issue: why it matters and how to fix it — written for someone who is not a developer.
The six questions we answer
Trustack scores your application against the Trustack Production Ready Standard (TPRS-0.1). Each area carries a weight, so a small documentation gap never looks like a security incident.
Security
Can someone steal your data, your keys or your users' accounts?
Operations & Resilience
When it breaks at 2am, will you know — and can you restore it?
Architecture & Configuration
Is your setup clean enough to change safely later?
Software Supply Chain
Do the libraries you installed carry known vulnerabilities?
Maintainability & Delivery
Could another developer take over without rewriting it?
Governance & Data
Do you know what data you hold and who is responsible for it?
What you actually receive
- A readiness score out of 100 with a clear verdict: ready, conditionally ready, not ready, or blocked
- 37 control results across six areas, each backed by the exact file, manifest or API response that justifies it
- Blocking problems isolated first — the short list of things you cannot ship without fixing
- A PDF report written for non-developers: what it means, why it matters, what to ask for
- A bill of materials (SBOM) of every component your application depends on
- A re-check after your fixes, so you can prove the progress instead of hoping
Where you are, where you go next
Questions people ask first
I'm not a developer. Will I understand the result?
That is exactly who the report is written for. Every finding says what it is in plain words, why it matters for your business, and what to ask a developer to do about it.
Do you keep a copy of my code?
No. We download the exact commit, analyse it in memory and discard it. We store the results and the evidence excerpts — never your source code, and never a raw secret.
Is this just an AI opinion on my code?
No. The score comes from a deterministic standard (TPRS). The same code and the same context always give the same result, and every point is tied to real analyzer evidence.
What if I can't fix the problems myself?
That's the normal case. Build Ready takes your application to production readiness for a fixed outcome-based price, sized from your own assessment result.