Question 1

What is DeployReady?

Accepted Answer

DeployReady is a production-readiness scanner. It runs 30+ structured tests against your code and your running app, gives you a 0–100 readiness score with prioritized findings, and proposes AI-powered fixes you approve before they are applied. It runs locally and works offline if you choose not to connect a model.

Question 2

Do I need to install anything?

Accepted Answer

No. The fastest way to use DeployReady is with npx: run "npx deployready@latest ./my-app" and it works without a global install. You can also install it globally or as a dev dependency if you prefer.

Question 3

Is DeployReady free?

Accepted Answer

DeployReady runs locally and is free to use. If you connect a paid AI provider like Claude or OpenAI, you are responsible for that provider’s usage costs. Local models via Ollama are free.

Question 4

Does DeployReady send my code to the cloud?

Accepted Answer

All static and dynamic analysis runs locally. If you enable AI, only redacted, structured findings (severity, type, file, line) are sent — never your raw source code, full secret values, or environment values. With Ollama, nothing leaves your machine at all.

Question 5

Do I have to use AI?

Accepted Answer

AI powers the deeper analysis and the approve-a-diff fix workflow. If you would rather not connect a model, every structured check still runs with the --no-ai flag — you get the readiness score and findings, just without AI explanations or auto-fixes.

Question 6

Which languages and frameworks are supported?

Accepted Answer

DeployReady analyzes JavaScript, TypeScript, and Python, and detects common frameworks like Next.js, Express, and Flask. Dynamic testing works against any app you can run on localhost.

Question 7

Can I use DeployReady in CI/CD?

Accepted Answer

Yes. Run it non-interactively with flags like --no-ai, --export, and --fail-on critical. Exit code 0 means clean, 2 means the gate failed (issues found), and 1 indicates a tool error. You can also adopt a baseline with --write-baseline so the gate fails only on new findings, not your existing ones.

Question 8

Can DeployReady actively try to break into my app?

Accepted Answer

Yes — with the opt-in --active flag and a logged-in user’s token, DeployReady acts as that user and tries to break access control: broken object-level authorization (IDOR/BOLA), broken tenant isolation (swapping org/tenant ids), privilege escalation (forging a role: admin claim), and unverified JWTs (accepting an alg:none token). Add --token-b with a second user’s token to prove isolation between two real identities. Run "--active" without a token and it shows you how to grab one from your browser.

Question 9

Is active testing safe to run?

Accepted Answer

It is safe by construction: active testing is opt-in (only runs with --active) and asks for confirmation, only targets your loopback app — never a remote host — and is GET-only, so it never writes or mutates data. Point it at a local or staging environment you own, not production.

Question 10

Does a clean scan mean my app is secure?

Accepted Answer

No. DeployReady reduces risk and catches common issues, but no automated tool can guarantee security. It is a tool to assist human review, not replace it. Always have a qualified person review findings and your overall architecture.

Question 11

Are the AI-proposed fixes safe to apply blindly?

Accepted Answer

No. AI suggestions can be wrong or incomplete. DeployReady always shows you a diff and requires explicit approval, and it backs up files before changing them. Review every change and run your own tests.

Question 12

Where can I get help or report a bug?

Accepted Answer

Visit the Contact page to reach the team, or the Feedback page to report bugs and request features. You can also open an issue on the GitHub repository.

Frequently Asked Questions