Methodology
The method behind the score
Every Bronkode assessment uses the same six-pillar framework, so you get a repeatable, evidence-based judgement instead of one person's opinion.
The six pillars
What we look at, and the question each pillar answers
Security
Can the wrong person get in, or the right data get out?
- Authentication
- Authorisation
- Dependency risks
- Secrets management
- Data protection
Architecture
Does the design hold up as usage and features grow?
- System design
- Service boundaries
- Data flow
- Scalability
Reliability
When something breaks, how quickly and completely do you recover?
- Backup strategy
- Recovery procedures
- High availability
- Failure handling
Engineering Maturity
Can changes be made safely, repeatably and by more than one person?
- Git usage
- Branch strategy
- Pull requests
- CI/CD
- Automated testing
Operational Readiness
Will you know something is wrong before your customers tell you?
- Monitoring
- Logging
- Alerting
- Runbooks
- Documentation
Cost & Vendor Risk
Will success bankrupt you, or a provider hold you hostage?
- Cloud costs
- AI API costs
- Dependency management
- Vendor lock-in
How scoring works
0–10 per pillar. One score out of 100.
Each pillar is scored from 0 to 10 against the checklist items above. The pillar scores are combined into an overall Production Readiness Score out of 100, and that score drives a clear recommendation.
| Pillar score | What it means |
|---|---|
| 0–3 | Critical gaps. Unsafe for real users or data. |
| 4–6 | Workable, with significant risks to address. |
| 7–8 | Solid. Minor improvements recommended. |
| 9–10 | Mature practice for a team of this size. |
- Security5/10
- Architecture6/10
- Reliability3/10
- Engineering2/10
- Operations3/10
What a report looks like
Findings you can prioritise, not a wall of text
Depending on the tier, your report includes some or all of the following.
Risk matrix · Tier 2+
Each finding is plotted by likelihood and impact, so the top-right gets fixed first.
Priority findings · Tier 2+
Rotate and move to a secrets manager.
Add build, test and deploy automation.
Risk heatmap · Tier 4+
An at-a-glance view for investors and boards.
Architecture diagram · Tier 2+
Users │ ▼ API │ ├── AI Provider ├── Database └── Storage
Data flow diagram · Tier 3+
Customer │ ▼ Frontend │ ▼ Backend │ ├── OpenAI ├── Stripe └── Database
What we don't do
Clear boundaries
- No active exploitation. We review code, configuration and practice. We don't attack your systems. If you need a penetration test, we'll tell you.
- No guarantees. An assessment reduces risk. It can't eliminate it.
- No coverage of later changes. The report reflects your codebase on the review date.
Run the framework on your own app
Start with the free checklist, or book a Launch Check and get your score from us.