AI Skill Report Card
Hardening Backend Production Readiness
Quick Start14 / 15
Paste this prompt into Claude Code first, before anything else:
Which of these backend risk categories is my app missing, and which one will hurt first:
database integrity, scaling, resilience/failure handling, or security?
Scan the codebase and rank the top 5 most urgent fixes.
Then work through the relevant category checklist below with the specific prompts provided. Don't run all 60+ prompts blindly — triage first, fix highest-blast-radius items first.
Recommendation▾
Add a couple of concrete before/after input-output examples (e.g., show an actual N+1 query diff or a transaction wrap example) to make the examples section more tangible rather than relying solely on prompt templates.
Workflow14 / 15
- Triage — run the Quick Start prompt to find which category is weakest.
- Pick one category (database, scaling/traffic, failure handling, or security).
- Run each item's check prompt against the codebase, one at a time — don't batch fixes blindly, review each diff.
- Verify — for anything touching data (migrations, transactions, backups), test in a non-prod environment first.
- Re-triage — once a category is clean, re-run Quick Start to confirm what's next.
Progress:
- [ ] Category 1: Database integrity (indexes, N+1, pooling, migrations, backups, transactions, race conditions, constraints, pagination, timezones, caching)
- [ ] Category 2: Traffic & scale (load testing, cold starts, timeouts, retries, idempotency, queues, background jobs, cron, webhooks, debouncing, autoscaling, CDN, images, bundle size)
- [ ] Category 3: Failure handling & observability (error tracking, logs, uptime, alerts, health checks, error boundaries, error pages, status page, rollbacks, feature flags, kill switches, circuit breakers, fallbacks, postmortems)
- [ ] Category 4: Security (validation, SQLi, XSS, CSRF, CORS, SSRF, password hashing, session expiry, token rotation, OAuth scopes, 2FA, webhook signatures, upload limits, dependency updates)
Recommendation▾
Consider trimming the long comma-separated lists in 'Traffic & scale' and 'Failure handling' into bullet checklists for better scanability, consistent with the Category 1/2 progress tracker format.
Category Reference & Prompts
Database (data integrity & performance)
- Indexes: "Look at my database queries and tell me which columns need an index. Add the missing ones."
- N+1 queries: "Find every N+1 query in this app and batch each one."
- Connection pooling: "Check how my app connects to the database and set up connection pooling the right way for where I deploy."
- Migrations + rollbacks: "Check that every database change goes through a migration file with a working down step."
- Backups + restore test: "Tell me how to set up automatic backups, then write a script to test restoring one into a test database."
- Transactions: "Find places where several writes belong together and wrap them in a transaction."
- Race conditions + row locking: "Find read-then-update patterns that could race under concurrent requests and add row locking."
- Unique constraints + foreign keys: "Find fields that should be unique or relationships missing foreign keys, and add them."
- Soft deletes: "Tell me which tables should use soft deletes without leaking deleted rows into queries."
- Pagination: "Find endpoints that return all rows unpaginated and add pagination."
- Timezones: "Store all dates in UTC, show them in user timezone."
- Caching + invalidation: "Find the slowest repeated work and add caching with correct invalidation on data change."
Traffic & scale
- Load testing: "Write a load test for my most important endpoints and tell me what breaks first."
- Cold starts, timeouts, retries with backoff, idempotency (payments/emails), queues, background jobs, dead letter queues, cron job monitoring, webhook fast-ack + dedup by event ID, debouncing user input, autoscaling limits/cost, CDN for static assets, image optimization, bundle size analysis.
Failure handling & observability
- Error tracking (server + browser), structured logs (JSON, request ID, never log secrets), uptime monitoring, alerts on error spikes/failed jobs, health check endpoint (include DB check), frontend error boundaries, friendly 404/500 pages, status page, rollback runbook, feature flags, kill switches for risky/costly features, circuit breakers around external deps, fallbacks when a dependency is down, postmortem template.
Security
- Input validation server-side, parameterized queries (no string-joined SQL), escape user content (XSS), CSRF protection on state-changing actions, restrictive CORS, block private/internal addresses on user-supplied URLs (SSRF), bcrypt/argon2 password hashing, session expiry with real logout, token/key rotation plan, minimal OAuth scopes, optional 2FA with recovery, verify webhook signatures, upload size/type limits enforced server-side, dependency update process.
Best Practices
- Triage before fixing. Not all 60+ items apply equally — a side project doesn't need a status page; a payments app desperately needs idempotency and transactions.
- Data-destructive items first in isolation. Migrations, backups, and transactions should be tested against a throwaway database, never prod.
- One category at a time. Running every prompt in one shot produces a huge unreviewable diff. Batch by category, review each.
- Security and data-integrity items are highest priority — they cause silent corruption or breaches, not just visible slowness.
- Re-run triage after each category — fixing one issue often exposes the next bottleneck (e.g., adding caching reveals you now need invalidation).
Common Pitfalls
- Don't let Claude Code apply all fixes in one giant commit — you lose the ability to review and bisect if something breaks.
- Don't skip testing backup restores — an untested backup is not a backup.
- Don't add retries to non-idempotent actions (e.g., retrying a payment charge without idempotency keys causes double charges).
- Don't treat feature flags/kill switches as optional for anything involving money, AI API calls, or public signups — these are the fastest way to stop a runaway bill or abuse case.
- Don't skip the "which one will hurt first" triage step — fixing low-impact items first while a critical one (e.g., no backups) remains is a false sense of security.