Executive Production AssessmentCONFIDENTIAL
The most urgent risk isn't visual — it's data access.
Database read/write permissions do not isolate data by user. In theory, any authenticated account can access another's records.
Production X-Ray
Find out what can stay and what needs to change before the product grows.
We review code, infrastructure, data, and critical flows to identify risks, technical debt, and the right stabilization sequence.
Scope and investment are defined after an initial triage.
When it makes sense
The problem rarely shows up alone.
- 01The product already has users, payments, or real data.
- 02Bugs keep coming back, even after being fixed.
- 03AI alone can no longer resolve the issues.
- 04New features create regressions in parts that seemed done.
- 05Another developer cannot confidently take over the project.
- 06You have lost confidence in what was built.
Investigation scope
What gets analyzed
- Authentication and authorization
- Database and permissions
- Secrets and environment variables
- Payments, webhooks, and integrations
- Architecture and technical debt
- Tests for critical flows
- Backups and restoration
- Deploy, rollback, and monitoring
The depth of the analysis depends on the context. For larger products, we work with representative samples of the most critical flows.
See what you get
Not a list of problems. A sequence of decisions.
A simulated excerpt of the artifacts: the level of clarity, prioritization, and decision-making you receive at the end of the X-Ray.
ADR-002DECISION
Fix database access rules
- Context
- database access rules do not stop one user from reading another's data.
- Alternatives
- trust the interface alone, rewrite the backend from scratch, or review the existing rules.
- Decision
- review and fix database access rules before any other change.
- Consequence
- closes the most severe risk without requiring a rewrite.
30-day Stabilization Planv1.0
Stabilization sequence
- NOWFix database access permissions and review exposed secrets
- NEXTSeparate development and production environments, set up automatic backups
- LATERCover payment flows with tests and monitoring
Simulated example. The actual artifacts reflect your product's code, risks, and decisions.
The X-Ray points the way. The Sprint can walk it.
The X-Ray can be executed by your own team, another vendor, or Origammi. When Origammi executes the fixes, that happens in the Stabilization Sprint.
Let's start
Before rewriting, find out what is actually wrong.
FAQ
Questions before deciding.
What kind of access does Origammi need?
Usually, read access to the repository, to the provider dashboard (Supabase, Firebase, Vercel, or similar), and time to talk with whoever built the product. We define the minimum necessary access during the initial triage.
Do I need to share my credentials?
We never ask for passwords or keys through a form. Access is granted via a collaborator invite, temporary access, or another proper mechanism — and revoked once the work is done.
Do you review the entire codebase?
For small products, yes. For larger or more complex ones, we work with representative samples of the most critical flows, to keep the X-Ray focused and fast.
What do I get at the end?
An executive assessment, a risk map with issues classified by impact and urgency, recommended decisions (keep, protect, refactor, replace, or rebuild), and a prioritized stabilization plan — presented in a live readout.
Am I required to hire Origammi to fix the issues afterward?
No. The X-Ray can be executed by your own team, another vendor, or Origammi. When Origammi executes it, that happens as a separate Stabilization Sprint — a later decision, not an obligation.
How is my product's confidentiality handled?
We sign a confidentiality agreement when needed. Access is minimal, used only for the investigation, and revoked once the work is done.
How much does the Production X-Ray cost?
We don't publish a fixed price, because scope varies a lot with product size and complexity. Scope and investment are defined after a free initial triage.