ship-gate

---
name: ship-gate
description: Use when preparing to deploy or ship code to production; runs pre-deployment audit across security, database, code quality, dependencies, AI/LLM, deployment, frontend, and observability.
category: Engineering
version: 1.0.0
tools: []
---

# Ship Gate

Pre-production audit: scan before deploying to verify security, database, code quality, and observability readiness.

## When to Use

When the user says "push to production", "deploy", "ship it", "go live", or similar — intercept and run this audit first.

## How It Works

### Step 1: Detect Stack

Identify the project stack (Next.js, React, Vue, Django, FastAPI, Go, Rust, etc.) and deployment target (Vercel, Netlify, Fly.io, Railway, Docker, etc.).

Framework detection patterns:
- Node.js: `package.json` with "next"/"react"/"vue"/"svelte"/"astro"/"express"/"fastify"/"hono"
- Python: `requirements.txt` or `pyproject.toml` with "django"/"flask"/"fastapi"
- Go: `go.mod`
- Rust: `Cargo.toml`
- Database: "supabase"/"prisma"/"mongoose"/"pg"/"postgres"/"firebase"
- Auth: "@clerk"/"next-auth"/"@supabase/auth-helpers"/"firebase/auth"
- Deploy: `vercel.json`/`.vercel/`, `netlify.toml`, `fly.toml`, `railway.json`, `Dockerfile`
- AI/LLM: "openai"/"@anthropic-ai/sdk"/"@google/generative-ai"

Report detected stack before proceeding.

### Step 2: Run Automated Checks

Eight categories, each with auto-scannable checks. Run in order: SEC, DB, CODE, DEP, AI, DEPLOY, FE, OBS.

Report progress after each category.

| Prefix | Category | Auto checks | Manual checks |
|--------|----------|-------------|---------------|
| SEC | Security | 15 | 3 |
| DB | Database | 7 | 5 |
| DEPLOY | Deployment | 3 | 8 |
| CODE | Code Quality | 11 | 0 |
| AI | AI/LLM Security | 5 | 3 |
| DEP | Dependencies | 5 | 0 |
| FE | Frontend Quality | 7 | 3 |
| OBS | Observability | 2 | 5 |

Report results as:
- **PASS**: check passed
- **FAIL**: issue found (with file path, line number)
- **SKIP**: not applicable to detected stack

### Step 3: Manual Confirmation

For non-automated checks (backup tested, rollback plan, staging test), present as a checklist.

### Step 4: Verdict

Classify findings into three severities:
- **CRITICAL** (must fix): secrets exposed, no auth on routes, no HTTPS, SQL injection vectors, no RLS on database tables
- **HIGH** (should fix): no error boundaries, no rate limiting, console.logs in production, no pagination
- **ADVISORY** (recommended): no OG tags, no custom 404, no analytics, no SBOM

## Scope

This skill audits only. Does not fix. Reports issues with file locations and remediation guidance.

Does not:
- Set up CI/CD pipelines
- Provision infrastructure
- Configure monitoring tools
- Run after deployment (pre-deploy only)