"Is this service ready for production?" is a question that deserves a systematic answer, not an opinion. VibeControls security scorecards make production-readiness a measurable, tracked property of every service.
The scorecard system runs weighted checks against services registered in the catalog. Checks are organized into tiers: Bronze (baseline — has an owner, has a README, passes a secrets scan), Silver (intermediate — SBOM generated, DAST clean, no critical CVEs), Gold (production — all Silver checks, plus runtime security monitoring, incident runbook documented).
Checks are populated by the security plugin ecosystem. Secrets scan results come from vibe-plugin-security-secrets-pr. SBOM build results from vibe-plugin-security-sbom-build. Custom policy rules run through the release-gate plugin. The scorecard aggregates them.
The catalog view shows each service's current tier. Red badges on services that have regressed. Trend lines show whether security posture is improving or declining. Security officers can filter by tier to find the services that most need attention — and link directly to the failing checks for a remediation plan.
Release gates can block a deployment if a service hasn't met its tier requirements. Scorecards go from vanity metric to deployment prerequisite.
Do it yourself
Grade each catalog service against a Bronze/Silver/Gold security checklist, feed real scan results into the scorecard from CI, and see each service's production-readiness tier and remediation right in the catalog.
Go to your service catalog and click into the service you want to grade for production-readiness.
You should see: The service detail page opens with tabs across the top, including a Scorecard tab.
Ready to make this your story?
