I audited my own app before launch. Here's what I found.
I audited my own app before launch. Here's what I found.
I don't trust my own code. Neither should you.
Before Hush — a platform I'm building for South African car enthusiasts — goes anywhere near a public launch, I ran a full production-readiness audit. Not a quick checklist. A proper systems architecture audit, category by category, scoring each one.
The result: 55-60% ready.
Not great. Honest. Here's everything that's actually wrong.
What Hush is
Hush is a React 19 PWA for South African car culture. Think: live meet maps, crew formation, drag timers, group chat, walkie-talkie voice, and a 3D AI garage. It's live on Vercel with a waitlist, and the core features work.
"Works" and "launch-ready" are very different things.
The scorecard
| Category | Score | Status | |----------|-------|--------| | Core features | 75% | Functional but incomplete | | Security | 50% | Admin panel is client-side only | | Data integrity | 40% | Missing tables, missing RPCs | | Payments | 30% | Return flow not implemented | | Performance | 55% | No lazy loading, no CDN config | | Error handling | 60% | Basic, no tracking | | Operations | 20% | No monitoring, no backups, no CI/CD | | Legal | 10% | No ToS, no privacy policy |
The critical stuff (launch blockers)
3 missing database tables. The app references cars, daily_usage, and waitlist tables that don't exist in the database. Features that depend on these will crash at runtime. Not "might crash" — will crash, for any user who hits those code paths.
1 missing RPC function. send_friend_request is called by the frontend but doesn't exist in the database. Friend requests are broken.
7 storage buckets not created. File uploads (car photos, profile pictures, voice notes) have nowhere to go. The code assumes Supabase storage buckets that were never set up.
Admin panel is client-side only. The admin check runs in the browser JavaScript. Anyone who knows how to open DevTools can bypass it. This isn't a theoretical risk — it's trivially exploitable.
Payment return flow not implemented. When a user pays and gets redirected back to the app, nothing happens. The payment is captured but the user's account isn't upgraded. This is the single biggest launch blocker — you can't charge people without this working.
The important stuff (needs fixing within 4-6 weeks)
No monitoring. If the app goes down at 2 AM, I won't know until someone tells me. No uptime checks, no error tracking, no alerting.
No backups. The database has no automated backup strategy. A single DROP TABLE mistake — by anyone with database access — could wipe everything.
No CI/CD. Every deploy is manual. No automated tests, no staging environment, no rollback procedure.
No legal pages. No Terms of Service. No Privacy Policy. In South Africa, POPIA compliance isn't optional.
What's actually good
The core features work. The live meet map, crew system, drag timer, chat, and walkie-tallie are functional and tested. The UI is polished. The waitlist system captures emails correctly.
The foundation is solid. The gaps are in the infrastructure around the product, not the product itself.
The 4-phase launch plan
Phase 0 — Critical fixes (2 weeks): Create the missing tables, RPCs, and storage buckets. Implement server-side admin auth. Build the payment return flow. This is non-negotiable.
Phase 1 — Infrastructure (2 weeks): Set up monitoring, automated backups, CI/CD pipeline, error tracking.
Phase 2 — Legal and compliance (1 week): Write ToS, Privacy Policy, POPIA compliance documentation.
Phase 3 — Scale preparation (1 week): Load testing, CDN configuration, performance optimization.
Total: 4-6 weeks from audit to launch-ready.
Why I'm publishing this
Because most launch post-mortems happen after something goes wrong. I'd rather be honest about where things stand now than pretend everything's fine and deal with angry users later.
If you're building something and haven't done a proper audit yet — do it. Not after launch. Before.
Hush is a React 19 PWA live at hush-v1.vercel.app. Waitlist is open. The audit described here was conducted on May 16, 2026, and the 4-phase fix plan is in progress.
Akhil Pillay
Agentic Systems Architect & AI Advocate
This post was written by Jarvis — Akhil's Hermes AI agent — and vetted by Akhil before publishing.
Enjoyed this? Join the community for more AI agent insights.