🪤 TRAP — True Readiness Audit Prompt

An adversarial, evidence-first production-readiness audit you run on your own codebase — before someone else runs it for you.

📋 Copy the prompt · 🚀 Quick start · 🧭 The 11 phases · ☕ Support

[!WARNING]
"It works on my machine" is not a security posture. Vibe-coded apps ship with exposed service keys, unenforced tenant isolation, and rate limits that exist only in the prompt that asked for them. TRAP is the cold-shower review that finds those things before your users — or an attacker — do.

What is TRAP?

TRAP is a single, copy-pasteable prompt that reprograms your AI coding assistant into a 10-person adversarial review board — Staff Engineer, Principal Security Engineer, Pentester, OWASP Specialist, DBA, Cloud Architect, Privacy & Compliance Consultant, Release Manager, and more — speaking in one consolidated voice.

Its only job: decide whether your app is genuinely production-ready, and hand you the exact path to make it so.

If you've been looking for a Claude security review, an AI security audit, or a real production-readiness checklist for an app you built with Lovable, Bolt, v0, Cursor, Replit, or Claude Code — that's what TRAP is. The difference is it refuses to guess.

It is built around one uncomfortable idea:

An invented finding is worse than a missing one, because it manufactures false confidence.

So TRAP refuses to guess. Every single claim it makes must carry a verdict:

If it can't point at the code, it doesn't get to call you secure.

Why it's different

Most "review my app" prompts are flattery machines — they pattern-match a framework's typical structure and hand back a reassuring ✅. TRAP is engineered specifically to resist that.

Others go the opposite way: they're personality kits. They hand the model a name, a job title, a backstory, and a bedside manner, so the review sounds like it came from a grizzled security engineer. It's a genuinely fun trick and it makes the output feel warm, human, and authoritative — but a persona doesn't read your code. How an agent talks to you has nothing to do with whether it actually found the IDOR. Worse, a friendly, confident voice wrapped around an unverified finding is more dangerous than silence: it feels like diligence while delivering none. TRAP spends its words on method, not manner — what to check, what counts as proof, and what to admit when the proof isn't there.

• 🚫 Access Gate (Rule 0). No repo access? It refuses to audit and tells you so — instead of hallucinating a report from vibes.
• 🔬 Asserted ≠ Verified. An access-control policy that exists but isn't proven by a real cross-tenant test is reported as NOT PRESENT. Enabling a guard you never tested is treated as worse than not having one.
• 🎯 Coverage rule. Finite sets (routes, env vars, migrations, upload handlers) get enumerated and audited individually — no implying full coverage from a sample.
• ⚖️ Severity × Confidence on every finding. And it's forbidden from inflating severity on unverified hunches to "play it safe."
• 🗡️ Attack Mode (Phase 6). It stops reviewing and starts attacking — likelihood, impact, difficulty, and whether your logging would even catch it.
• 🪞 Mandatory Self-Challenge. Before it's done, it audits its own report for over-claiming and downgrades anything it inferred rather than read.
• 🔁 Remediation Loop. A fix is only "done" when its specific exploit test passes — not when the code merely looks correct.

[!IMPORTANT]
TRAP is the floor, not the ceiling. It reliably catches OWASP-class issues, secret exposure, IDOR/tenant gaps, missing rate limits, and config holes. It does not reliably catch business-logic flaws, subtle race conditions, or anything needing live runtime behavior. For regulated data (HIPAA/PCI/COPPA), it explicitly tells you a human audit is still required. A clean TRAP report is a strong signal — not a compliance certificate.

🚀 Quick start

1. Open your AI coding assistant in your project (Claude Code, Cursor, Copilot Chat, etc.) so it can actually read your files.
2. Copy the full prompt from TRAP.md — everything below the divider.
3. Paste it as a single message.
4. Watch Rule 0 fire. It first confirms it can see your code (root path + rough file count). If it can't, it stops. Good — that's the point.
5. Read top-down. The Executive Summary gives you a letter grade and a ✅ Ready / ⚠️ Ready with Conditions / ❌ Do Not Deploy call. The Remediation Roadmap gives you the ordered path out.
6. Fix, then loop. Hand back your changed files and ask it to re-audit only the delta. Repeat until ✅ Ready with zero open Critical/High findings.

┌────────────────────────────────────────────────────────────┐
│  Give AI repo access  →  Paste TRAP.md  →  Rule 0 gate      │
│        ↓                                                    │
│  11 phases of evidence-based audit                          │
│        ↓                                                    │
│  Graded report + exact diffs + remediation roadmap          │
│        ↓                                                    │
│  Apply fixes  →  Re-audit the delta  →  ✅ Ready            │
└────────────────────────────────────────────────────────────┘

💡 Tip: Run TRAP against an assistant that has genuine, full read access to the repository. The audit is only as good as the code it can actually see — that's why Rule 0 exists.

🧩 Or install it as a skill (auto-activates)

Prefer not to paste? TRAP also ships as a Claude Code Agent Skill, so it can trigger itself when you ask to "security-review" or "check if this is production-ready" — no copy-paste.

# Clone TRAP, then drop the skill into your Claude Code skills folder.

# Global — available in every project on your machine:
git clone https://github.com/bikr/TRAP.git
mkdir -p ~/.claude/skills && cp -r TRAP/skills/trap ~/.claude/skills/

# …or project-scoped — just the repo you're standing in:
mkdir -p .claude/skills && cp -r /path/to/TRAP/skills/trap .claude/skills/

How it works: Claude Code auto-discovers any folder in .claude/skills/ that contains a SKILL.md. TRAP's SKILL.md carries a description in its frontmatter that tells Claude when to reach for it — so a request like "run TRAP," "audit this before I ship," or "is this production-ready?" activates it automatically, and it then executes the full method from PROMPT.md. Update it later with a quick git pull in your cloned copy, then re-run the cp.

Then just ask — "run TRAP", "audit this for production", "security review before I ship" — and the skill activates and runs the full audit. The skill uses the exact same canonical method as TRAP.md; skills/trap/PROMPT.md is a mirror of it.

👀 See it in action

Curious what TRAP actually hands back? Read a full example audit → — an illustrative run against a fictional Next.js + Supabase + Stripe app, showing every section of the output: the letter grade, the deployment blockers, the findings table, exact diffs, the remediation roadmap, and the final verdict.

It demonstrates the rules that make TRAP different — NOT PRESENT treated as a finding, an RLS policy that exists but isn't proven flagged as a Critical, and a Verification Appendix you can re-run yourself.

🧭 How it works: the 11 phases

TRAP forces a build-then-break sequence. It won't review controls until it has modeled the system, and it won't stop at the happy path.

Then comes the Output Format (executive summary → findings table → exact code diffs → prioritized roadmap → scorecard → final verdict), the Self-Challenge, and the Remediation Loop.

1. Executive Summary — letter grade + deploy recommendation + the single most important reason.
2. Critical Issues — every blocker first, with its one-line fix and the threat it enables.
3. Findings Table — Severity · Confidence · Category · Issue · Verdict · Evidence (file:line) · Fix.
4. Exact Code Changes — real diffs matching your stack and conventions.
5. Prioritized Remediation Roadmap — Must do before real customer data · Should do before public launch · Can do after launch, each with S/M/L effort.
6. Unknown / Operational Items — everything unverifiable, with how to verify it. Never converted into a pass.
7. Verification Appendix — the exact commands/greps/queries so another engineer can independently reproduce the result.
8. Final Scorecard — 1–10 across Security, Architecture, Performance, Reliability, Maintainability, Privacy, DevOps, Production Readiness, Testing, Overall.
9. Final Verdict — "Would you personally approve this for production at a company handling millions in annual revenue?"

🧰 Which tools does it work with?

TRAP is plain text — it runs anywhere you can paste a prompt and give the model repo access. It shines most where the assistant has genuine file access:

[!NOTE]
If the assistant can't read your actual source, TRAP is designed to refuse rather than fake it. That refusal is a feature, not a bug. Vibe-coding platforms like Lovable, Bolt, v0, and Replit are fantastic at shipping features fast — TRAP is the check that the speed didn't leave a hole behind.

🗂️ Repository layout

TRAP/
├── README.md              ← you are here
├── TRAP.md                ← the canonical prompt (latest)
├── skills/trap/           ← install as a Claude Code Agent Skill
│   ├── SKILL.md           ← skill manifest + activation triggers
│   └── PROMPT.md          ← mirror of the canonical method
├── prompts/
│   └── TRAP-v2.0.0.md     ← versioned snapshots
├── docs/
│   └── EXAMPLE-AUDIT.md   ← what a TRAP run looks like
├── CHANGELOG.md           ← what changed between versions
├── CONTRIBUTING.md        ← how to propose improvements
├── LICENSE                ← MIT
└── .github/               ← issue templates, funding

🤝 Contributing

TRAP gets sharper every time it's run against a real codebase and misses something. If you find a gap, a false-confidence trap it didn't catch, or a phase that needs tightening:

• Open an issue describing what slipped through (redact anything sensitive).
• Or send a PR — see CONTRIBUTING.md.

The prompt is versioned with semantic versioning. Wording changes that alter audit behavior bump the version.

☕ Support

If TRAP caught something before it cost you a 2 a.m. incident, a leaked key rotation, or a breach disclosure — consider buying me a coffee. It directly funds keeping this prompt sharp.

📜 License

MIT © bikr. Use it, fork it, adapt it for your team. Attribution appreciated, not required.