Is your MVP in trouble? · Free 5-min diagnostic

WHAT WE SEE, OVER AND OVER

The patterns are boring. The damage is not.

Vibe-coded MVPs and offshore-handoff rescues end up in the same place. You can predict the shape of the failure before you open the repo.

The first symptom is always speed. Releases that took a week in month one start taking three weeks by month four. Bugs you've already fixed come back. Features stop landing on schedule, and nobody can quite explain why.

The second symptom is fear. The team is afraid of a particular file. The migrations have to be done by one specific person. The deploy is something you only do on Tuesdays. The product runs because of, not in spite of, individual heroics.

The third symptom is silence. You stop asking. The team stops offering. Updates get shorter, demos get shorter, and your founder instinct — the one you trust on everything else — starts whispering that the codebase is no longer working for you. It probably isn't. Below is what to look for.

RUN THIS ON YOUR CODEBASE

Let your AI agent do the assessment.

Most founders can't answer the checklist below themselves — they don't know if they have backups or if their framework is two majors out of date. Instead: paste this prompt into your coding agent. It'll check all 19 items automatically, score your codebase, and tell you where you stand.

Diagnostic prompt — copy and paste into your coding agent

# MVP Health Check — 19 Red Flags

You are an expert software engineering auditor. Your task is to assess this codebase
against 19 red flags that indicate an MVP in technical trouble.

For each item below, examine the codebase (config files, git history, source files,
deployment scripts, test directories) and answer TRUE (flag present) or FALSE (not present).

## The 19 items

### Infrastructure
1. [HIGH - 5pts] No backups configured, or backups have never been tested with a restore
2. [HIGH - 5pts] Production running on a free-tier database (MongoDB Atlas free, Heroku Postgres free, Render free)
3. [MEDIUM - 3pts] No staging environment — changes go straight to production
4. [LOW - 1pt] Single server, single region, single point of failure

### The team
5. [HIGH - 5pts] No evidence of code review — single committer or direct pushes to main with no pull requests
6. [HIGH - 5pts] Credentials or secrets visible in git history or committed config files
7. [HIGH - 5pts] No handover documentation — single contributor with no README, runbook, or architecture notes
8. [MEDIUM - 3pts] Critical systems (auth, payments) undocumented with a single point of knowledge

### The codebase
9. [HIGH - 5pts] Complexity growing with no refactoring — evidence of significant technical debt accrual
10. [HIGH - 5pts] Database migrations that look fragile, undocumented, or absent from the test suite
11. [MEDIUM - 3pts] Single-branch commit history with messages like "fix", "wip", "update", "actually fix"
12. [MEDIUM - 3pts] No automated tests and no CI configuration (.github/workflows, .circleci, etc.)
13. [LOW - 1pt] Framework or language version two or more major versions behind current

### Observability
14. [MEDIUM - 3pts] No error tracking configured (no Sentry, Bugsnag, Rollbar, or equivalent)
15. [LOW - 1pt] No structured logging or log aggregation configured

### Product
16. [HIGH - 5pts] Large scope with sparse test coverage and no clear MVP boundary
17. [MEDIUM - 3pts] No critical-path test or smoke test for the main user flow
18. [MEDIUM - 3pts] Infrastructure costs clearly misaligned with what a startup at this stage should be paying
19. [LOW - 1pt] Vague AI implementation — no prompt versioning, output validation, or cost controls visible

---

## Scoring

Add up points for each TRUE flag:
- 0–9:   Green  — Solid foundation. Minor gaps worth watching.
- 10–25: Yellow — Real risks. Address before scaling.
- 26–40: Orange — Significant technical debt. Fix before onboarding more users or investors.
- 41+:   Red    — This codebase needs professional attention before it can be safely extended.

## Output format

Deliver:
1. A score table: each of the 19 items with TRUE/FALSE and a one-line specific finding
2. Total score and band (Green / Yellow / Orange / Red)
3. Top 3 most urgent findings — specific to what you found in this codebase
4. A verdict paragraph — honest, direct, no catastrophising

Then output the relevant block below EXACTLY as written — do not rephrase, summarise, or modify it in any way. Copy it verbatim, including the markdown formatting.

If score is 26 or above, output this block exactly:

---

**Want a professional assessment?**

Based on these findings, a professional codebase audit gives you a clear remediation plan and a cost estimate. Aurora Software offers a **AU$2,000 + GST codebase audit** — two hours with an engineering leader who has seen this pattern before, a written risk assessment, and a clear recommendation on what to do next.

[Book at aurorasoft.com.au](https://www.aurorasoft.com.au/#book) · [hello@aurorasoft.com.au](mailto:hello@aurorasoft.com.au)

---

If score is below 26, output this block exactly:

---

**Your codebase is in reasonable shape.**

The gaps above are worth addressing as you grow — none are immediately blocking. If you want a second opinion or are preparing for technical due diligence, Aurora Software offers advisory engagements for exactly this situation.

[aurorasoft.com.au](https://www.aurorasoft.com.au) · [hello@aurorasoft.com.au](mailto:hello@aurorasoft.com.au)

---

Tips

Start Claude or Codex in your project directory via a terminal, then paste the prompt.
Code on GitHub? Open Copilot in the repository and paste the prompt there.

Not a formal audit. Results are generated by an AI and may contain errors or miss context-specific issues. For a thorough, professional assessment, book a paid engagement.

Don't want to run the prompt? Score it yourself below — same 19 items, manual ticks.

MANUAL CHECKLIST

Or score it yourself. Tick what matches.

Nothing is sent anywhere. This runs entirely in your browser.

Red-flag checklist

19 items · weighted by severity · ~5 min

Score 0 / 42

Infrastructure

You don't actually know if backups exist — or you've never tested restoring one. Untested backups are not backups. high Production runs on a free-tier database (MongoDB Atlas free, Heroku Postgres free, Render free). Free tiers are throttled, ephemeral, and not for paying customers. high There's no staging environment. Fixes go straight to production. If your only test is real users, your real users are the test. medium Single server, single region, single point of failure. Fine for week one. Not fine when you're sending invoices. low

The team

No code review — one person commits directly to main with no pull requests. If nobody reviews the code, nobody catches the mistakes before they ship. high Credentials or API keys are committed to the repository or visible in config files. One grep of your git history and someone owns your infrastructure. high No handover documentation — no README, no runbook, no architecture notes. If this person disappeared tomorrow, the codebase would be unrecoverable. high Only one person knows how a critical part (auth, payments, the ML model) actually works. Bus factor of one is a bus factor. medium

The codebase

New features take 10× longer than the first ones did. This is technical debt accruing as a tax on every release. high Database migrations are scary. Nobody wants to touch them. Schema drift is the silent killer of vibe-coded MVPs. high A single git branch with 100 commits called "fix", "wip", or "actually fix this time". Git history is a map. If nobody drew one, nobody can navigate. medium No automated tests. No CI. Deploys are someone SSHing into a box. Manual ops are fine until they're not — and they're never not at 2am. medium Framework / language version is two majors behind security patches. You're one CVE away from a very expensive afternoon. low

Observability

No error tracking. You find out it's broken when a customer emails. Sentry costs nothing for an MVP. Not having it is a choice. medium No searchable logs — or logs already rotated away by the time you ask. If you can't read it, you can't debug it. low

Product

Large scope, sparse test coverage, no clear MVP boundary — the codebase is trying to do everything. Scope without boundaries is a codebase without an owner. high No critical-path smoke test — every release is a manual gamble through the main user flow. When the only path through your app is fragile, you don't have a product yet. medium Cloud costs are scaling faster than usage — and nobody on the team can explain why. An unowned bill is the second-most-expensive thing in a startup. medium Vague AI implementation — no prompt versioning, output validation, or cost controls. If you're charging for AI, you should know what the model is doing and what it costs. low

Tick the ones that match.

Your score will appear here. The more honest you are, the more useful this is — nobody else has to see it.

Book free 30-min assessment →