If a new developer opened your codebase tomorrow, what would they find?
Scorecard · methodology
How the readiness grade is made.
The Production Readiness Scorecard is a free, two-minute self-assessment that grades how close an AI-built product is to something you can safely sell. This is the method in full: the nine questions, the eight dimensions, how the score is worked out, and the four bands it lands in. No account, and the grade is instant.
9 questions · 8 dimensions · 4 bands · freeWhat it measures
Nine questions, eight dimensions.
The dimensions are the things a serious buyer, or a breach, tests first. Security is split into two, access and exposure, because it carries the highest stakes and separates products the most. Each question is phrased the way a founder would actually answer it.
When something goes wrong for a user mid-action, what happens?
Who can see and do what inside your product?
Where do your secrets and database credentials live, and can your inputs be abused?
If your database were corrupted or wiped tonight, what's your position?
What happens if a hundred people use it at once tomorrow?
When you change something, how do you know you haven't broken something else?
Your first serious buyer sends a security questionnaire and asks about SOC 2. What happens?
How does a change get from your machine to live?
The ladder
Four rungs, weakest to strongest.
Every question offers four answers, scoring 0, 1, 2 and 3. They are written so that simply reading the top rung tells you what good looks like. Here is the data question, in full.
- Rung 0 · scores 0
I'd lose everything
- Rung 1 · scores 1
There might be a backup somewhere
- Rung 2 · scores 2
Automated backups exist
- Rung 3 · scores 3
Automated, tested backups, plus a clear UK GDPR position on customer data
The score
A percentage, not a running total.
The score is the points you earned as a percentage of the points attainable on the path you actually took. Add up the rungs, divide by three times the number of scored questions answered, and that is your percentage.
It has to be normalised because different founders answer different questions. A raw sum would punish anyone who took a longer path and reward a shorter one, so the two would not be comparable. Questions that are shown but not scored count toward neither the total nor the divisor.
score % = (sum of rungs ÷ (3 × scored questions answered)) × 100
Fair by design
The path bends to what you built.
A pre-revenue side project and a product with paying customers should not be graded on the same questions. Grilling a founder with no users about SOC 2 and load-tested scale is tone-deaf, so those two questions soften into awareness-framed versions and stop counting toward the score.
What decides the path is a short, structured read of your one-line description: the likely domain, how sensitive the data is, and who the buyer probably is. Where data sensitivity is high, security and data are weighted to surface sooner among your weakest points. Your description is only ever treated as information to assess, never as instructions.
The bands
Where the percentage lands.
The score maps to one of four bands, shown with the “% ready” figure and a one-line verdict.
Prototype
0–35%It runs. It isn't something you could safely sell yet. There's real work between here and a product a buyer would trust.
Fragile
36–60%The shape is there. Under a serious customer it would strain, and a focused round of hardening is what stands between this and solid.
Hardening
61–80%Close. A handful of deliberate fixes stand between this and something ready for demanding buyers.
Sellable
81–100%Solid. The fundamentals a buyer looks for are largely in place, worth protecting as it grows.
The report
Three risks, worst first.
The detailed report ranks your three weakest dimensions, worst first. On a close call, security and data win the tie, because those are the failures that turn into an incident rather than an inconvenience.
Each risk gets a specific finding and a line on what good looks like. The structure, the “what good looks like” lines and the close are fixed and owned by Kyln; a model writes only the specific wording, and a deterministic version stands in if it cannot. The sharpening follow-up questions come from a curated bank, never written by a model. The failure modes it looks for are the usual ones behind an AI build: access that is not scoped, secrets in the browser, backups nobody has restored, no staging or rollback, no tests, and no answer ready for a buyer's security questionnaire.
Run it
Two minutes, then a grade.
Now that you know how it is scored, the honest way to use it is to answer honestly. The grade is only as good as the answers.
Scorecard methodology questions
Want to talk through a result? Email contact@kyln.digital
Yes. No account, and the top-line grade is instant. You give an email only to unlock the detailed report: your three biggest risks, ranked worst first, each with a line on what good looks like. One email, no spam.