Craft · Interactive
From prompt to production — the honest gap
“It generates” and “it’s ready to ship” are different claims. The checklist below scores what’s actually done, from your own answers — it doesn’t read your code, and it won’t tell you “production ready” even at 100%.
What you’re browsing for vs. what you need to know: you probably want a yes/no answer. What you actually get here is a mirror for your own knowledge of your build — useful precisely because it refuses to be more confident than your answers support.
The gap
What “it generates” usually leaves out
A generated page or endpoint can look complete while several categories that matter once real users arrive are still untouched. These map to categories in OWASP’s current Top 10 web-application risks and OWASP’s API Security project — not because every generated app is a target, but because these are the named, documented categories worth checking against.
- Input validation — checking type, size and shape of every input on the server, not only in the browser (OWASP A05:2025 Injection, A02:2025 Security Misconfiguration).
- Authentication & access control — real sign-in and a per-request permission check, not a hidden button standing in for one (OWASP A01:2025 Broken Access Control, A07:2025 Authentication Failures).
- Error handling — controlled, generic failures instead of a raw stack trace reaching the visitor.
- Rate limiting — throttling expensive or public endpoints so one visitor (or one bot) can't exhaust a paid API or a shared resource (OWASP API Security Top 10, API4 Unrestricted Resource Consumption).
- Tests — automated coverage of the core logic and at least one deliberately awkward edge case.
- A real data layer — durable storage for anything that should survive a refresh or a second device, not browser memory standing in for a database.
- Secrets hygiene — API keys and credentials kept out of frontend code and out of source control (OWASP A02:2025 Security Misconfiguration).
- Accessibility — keyboard reachability, contrast and alt text, covered in full on the Accessibility Basics page.
The checklist
Score your own build
Answer what you actually know to be true right now. Nothing is sent anywhere — it runs in your browser and resets when you leave the page.
Your score
—
0 of 15 answered
Answer at least one item to see a score. Every answer here is self-reported by you — this tool doesn’t read your code.
Input handling & validation
OWASP A05:2025 Injection · A02:2025 Security MisconfigurationAll inputs (forms, query parameters, uploaded files) are validated on the server, not only in the browser.
Size, type and range limits are enforced (max upload size, numeric bounds, string length).
User-supplied content is escaped or sanitized before it's rendered back or stored.
Authentication, access & secrets
OWASP A01:2025 Broken Access Control · A07:2025 Authentication FailuresReal sign-in exists for anything meant to be private — not just a hidden URL or a hidden button.
Every sensitive action is re-checked for permission on the server, not assumed from what the interface shows.
API keys and secrets live in server-side configuration, not in frontend code or committed to a repository.
Error handling & abuse limits
OWASP API Security Top 10, API4 · A09:2025 Logging & Alerting FailuresFailures return a controlled, generic error — not a raw stack trace or internal detail to the visitor.
Expensive or public endpoints (search, AI calls, email sends) are rate-limited per user or per IP.
There's a way to find out when something breaks in production — not just waiting for a complaint.
Tests & dependencies
OWASP A03:2025 Software Supply Chain FailuresCore logic has automated tests, including at least one deliberately awkward edge case.
Every package the generated code imports is one you've confirmed is real and maintained on its registry.
You've actually run the generated code yourself at least once, beyond watching it look right in preview.
Data & accessibility
WCAG 2.2 · see the Accessibility Basics pageAnything that should survive a refresh or a second device is stored in a real, durable data layer.
Interactive elements are reachable and usable by keyboard alone, with a visible focus state.
Images convey their meaning in alt text (or are marked purely decorative), and text meets WCAG contrast.
Fixing a “Not done” usually means going back to the studio with a tighter ask — naming the exact contract, not just saying “make it secure.”
Sources
- OWASP, “OWASP Top 10:2025” — the ten current web-application risk categories referenced above (A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A05 Injection, A07 Authentication Failures, A09 Security Logging and Alerting Failures). owasp.org/Top10/2025/. Accessed 27 Jul 2026.
- OWASP API Security Top 10 (2023 edition), “API4:2023 Unrestricted Resource Consumption” — the source for the rate-limiting item. owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/. Accessed 27 Jul 2026.
- W3C WAI, “Web Content Accessibility Guidelines (WCAG) 2.2” — the source for the accessibility item; full detail on the Accessibility Basics page. w3.org/TR/WCAG22/. Accessed 27 Jul 2026.
- MDN Web Docs, “Overview of HTTP” — HTTP's stateless design, the reason a real data layer is distinct from in-memory state. developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Overview. Accessed 27 Jul 2026.
FAQ