🛫 Preflight Security Audit
You vibe-coded an app. Everything works. But is it safe to ship?
A one-command, 61-check pre-ship audit for AI-coded apps — security, reliability,
performance, AI/LLM, privacy, and launch readiness — that finds the vulnerabilities,
scores your app 0–100, and fixes them.
Why this exists
AI writes code that runs. Running is not the same as safe. The gaps that ship
in AI-generated apps are boringly predictable — a missing auth check, a table
anyone can read, a webhook nobody verifies, a price the client can set — and they
don't show up when "everything works."
This plugin runs the checks a senior security engineer would run before launch, in
one command, and filters out the false positives that make most AI security
reviews useless.
I ship AI-coded products for a living, and the same thing kept happening: the app
worked, the demo looked clean — then a real hole showed up after launch. So I
built the check I wished I'd run before hitting deploy. On its first real run it
flagged a Critical in one of my own databases (a config table left world-writable)
that code review had missed. It's now 61 checks across 6 tracks with a 0–100 score, and it grows every
release.
Install
In Claude Code (or Cowork), run:
/plugin marketplace add akirtok/preflight-security-audit
/plugin install preflight-security-audit@preflight-security-audit
Installs straight from GitHub — no signup needed.
Use it
/audit # audit the whole project
/audit src/app # audit a subtree
/audit-fix critical # apply fixes for the Critical findings you approve
Or just say: "Run a preflight security audit on this project."
You get a severity-ranked AUDIT-<date>.md report and a clear
BLOCK / FIX-FIRST / GO ship recommendation. Nothing in your code changes
without your approval. See a sample report.
What's inside
61 checks across 6 tracks:
| Track | Focus |
|---|
| 🧬 Code Core | injection, auth, IDOR, secrets, error handling, races, N+1, memory, transactions, tests |
| 🕸️ Web/App Security | XSS, CSRF, SSRF, headers/CORS/TLS, crypto, file upload, rate limiting, Supabase RLS, live-DB grant audit, client-side storage, serverless/edge, GraphQL, Trojan Source & modern attacks, JWT |
| 🤖 AI/LLM Security | prompt injection (direct + indirect), output handling, sensitive disclosure, excessive agency |
| 🔒 Privacy & Compliance | PII inventory, GDPR/KVKK consent, cookies, retention & deletion, legal pages |
| 🚀 Launch Readiness | accessibility, SEO, Core Web Vitals, monitoring, backups, CI/CD, Stripe billing correctness, subdomain takeover, Docker |
| ✅ Verification | re-checks every finding, rejects anything it can't prove, calibrates severity, scores 0–100 |
What it catches (that "it works" hides)
- A Supabase table with RLS off + public write grants — anyone with the anon key edits your config
- A Stripe webhook accepted without signature verification — anyone can fake a "paid" event
- A price sent from the client and trusted — pay $0.01 for the $99 plan
- An
IDOR where changing an ID in the URL returns another user's data
- Prompt injection from user content that reaches your model's instructions
- PII written to logs; a "delete account" that doesn't actually delete
Who it's for
Solo builders and small teams shipping AI-generated apps fast — especially on
Next.js + Supabase + Stripe — who want a senior-engineer safety check before
they hit deploy.
Roadmap
⭐ Star the repo to follow along — new checks land as OWASP and the stacks evolve.
Get new checks by email
New checks ship regularly. Get an email when the important ones land — new Supabase,
Stripe, and OWASP coverage — no spam, just the changelog that matters:
Support this project
If it caught something before it bit you, you can sponsor on GitHub
or chip in via Stripe — it funds the rule
updates that keep it current. (There's a Sponsor button up top too.)
Version history
- v0.3.0 (2026-07-20) — 61 checks. Added client-side/browser-storage, serverless/edge, GraphQL/realtime, modern attacks (Trojan Source), advanced injections, exposed files, bot/DoS, JWT, subdomain takeover, Docker, and security.txt checks; a 0–100 security score; and stack-conditional gating so scans stay fast.
- v0.2.0 (2026-07-18) — 50 checks. First public release. Added the Live Database Advisor & Grant Audit for Supabase/Postgres.
- v0.1.0 (2026-07-15) — Initial 6-track build (security, reliability, performance, AI/LLM, privacy, launch readiness) with the false-positive verifier pass.
Standards
Checks align with OWASP Top 10:2025, the
OWASP LLM Top 10, and
ASVS 5.0.
Actively maintained — new checks land every release.
License
MIT — free to use, fork, and build on.
