Automated production checks

Fewer incidents.
Less toil. No manual auditing.

Three scheduled checks monitor your production environments continuously. When something needs attention, they surface it with full context and queue it for your team to review, not page you at 3am.

Drift Monitor

Unreconciled state is how deployment failures start

Someone resizes an instance during an incident. Someone tightens a security group in the console while debugging. These changes aren't malicious. They're operational. But they leave your declared infrastructure out of sync with what's actually running. The next deploy, the next plan, the next automated run will find that divergence. Better to find it on your terms.

Drift surfaces in minutes. Without this, it surfaces during your next incident.

What it does

1Scans all environments on a configurable schedule
2Runs plan diff to identify undeclared changes
3Filters noise: scaling events, timestamps, computed attributes
4Surfaces findings with the exact delta and affected resources
5Opens a reconciliation PR for team review
6Gates: policy, cost, and security checks
7Applies after human approval
8Confirms state matches reality after apply

What it will never do

Noise filtering is configurable per environment. Auto-scaling group sizes, lifecycle timestamps, and provider-computed attributes are excluded by default so routine activity never generates false findings in production.

Resource Audit

Orphaned resources are a cost problem that compounds silently

Every environment produces orphaned resources. A dev environment is torn down but a snapshot isn't. A load balancer is replaced but the old one isn't removed. An IP address is reserved and forgotten. None of these are large individually. Together, over months, they represent real spend, and occasionally a security surface that no one intended to leave open.

Average $2,400/year recovered per environment without a manual audit.

What it does

1Reconciles state files against live cloud API inventory
2Identifies resources present in cloud but owned by nothing
3Applies age and usage thresholds before flagging
4Calculates monthly cost per orphaned resource
5Opens a cleanup PR grouped by environment
6Gates: policy, cost, and security checks
7Applies after human approval
8Confirms resources removed after apply

What it will never do

Conservative by design. Resources are only flagged after passing configurable age thresholds (default: 30 days). Any resource with active dependencies is excluded. Resources tagged with protection labels are never touched.

Version Guard

Deferred upgrades make eventual upgrades expensive

Skipping minor version updates is understandable in the short term. But each skipped version is a tax on the next upgrade: more changelog to read, more deprecations to handle, more potential for breakage when you finally have to move. When a critical security patch comes out and you need to upgrade urgently, being three minor versions behind turns a one-hour task into a week-long project.

Versions stay current in small steps. Urgent upgrades stop being week-long projects.

What it does

1Monitors provider and module registry for new releases
2Identifies minor and patch updates across all projects
3Runs a dry-plan to verify compatibility before proposing
4Opens one PR per version candidate
5Gates: policy, cost, and security checks
6Applies after human approval
7Confirms versions updated after apply

What it will never do

The dry-plan is not optional. If the upgrade causes a plan failure, no PR is opened. Major version bumps are never proposed automatically. You only see upgrade proposals that are known to work against your current infrastructure.

Every finding goes through your approval workflow

No check self-applies. Each one surfaces a finding, opens a pull request, and waits. Your team sees the full picture: blast radius, cost delta, and policy results, then decides what happens. The checks do the looking. Your team makes the calls.

Check runsFinding surfacedPR openedPolicy + Cost + SecurityTeam reviewsApproved & applied
See the full approval workflow →

Stop finding production problems during incidents.

All three checks run on your infrastructure in under 30 minutes. Free tier available. No credit card required.