Production audit

Production Audit highlights concerns about your deployment configuration and current observed infrastructure. It distinguishes findings that need attention, recommendations, checks that passed, and facts that remain unknown. There is no aggregate security score and no automatic remediation.

Start with your local configuration

From your existing Kamal repository:

upstate audit --local
upstate audit --local --json
upstate audit --local --prompt

This path runs without Upstate authentication or network access. It inspects allowlisted static Kamal configuration, never executes embedded ERB and never reads secret values. Use --destination production to select one environment when the repository has more than one.

Review each finding's evidence and classification. Local config describes the checkout on your computer, not necessarily what you last deployed.

Compare with observed production

upstate audit
upstate audit --destination production --json

For an already connected project, the default audit uploads a sanitized snapshot of the local findings to Upstate and combines it with existing host observations and deployment history. It does not upload raw Kamal YAML, credentials or arbitrary environment values. Open the app's Production audit section to inspect durable findings and changes over time.

A finding does not automatically disappear when later input is missing. A new adequate check must show that the issue has resolved. Old or unsupported evidence stays clearly distinguished from confirmed healthy production.

Optional read-only server inspection

upstate audit --hosts
upstate audit --hosts --no-upload
upstate audit --hosts --no-upload --yes --json

--hosts is an explicit, consented inspection from your workstation over its existing SSH connection. It uses a fixed set of read-only commands to inspect high-level OS, SSH, firewall, patch/reboot and other host posture signals. It does not use sudo, modify host settings or open an inbound control channel from Upstate. Strict host-key verification applies.

--no-upload keeps its output local, and --yes skips the interactive confirmation after you review the intended hosts. Unsupported SSH transport, a missing host map or partial collection must not be interpreted as a clean audit. Inspect the errors before acting.

Work through a finding with your coding agent

upstate audit --prompt
upstate audit --hosts --no-upload --prompt

The resulting prompt is a bounded, sanitized summary you can copy into an agent session in the application repository. It asks the agent to inspect relevant code/config and produce justified changes. It does not authorize production commands or give the agent host credentials.

The web interface has a similar Copy prompt and findings action. Verify a suggested change in source control and deploy through Kamal yourself. For the accompanying deployment process, see Deploying with Kamal.

How to read the results

A Good result applies only to the specific check with sufficient evidence. Unknown may mean unsupported dynamic config, unavailable observations or inadequate inspection. A current Docker or network fact is not proof of Internet reachability or every effective firewall rule. A backup check-in can confirm that a job reported, not that a restore would work.

For general monitoring and stale data, see Monitoring. For stored diagnostic log tails, see Log snapshots.