preflight-security-audit

🛫 Preflight Security Audit

You vibe-coded an app. Everything works. But is it safe to ship?

A one-command, 61-check pre-ship audit for AI-coded apps — security, reliability, performance, AI/LLM, privacy, and launch readiness — that finds the vulnerabilities, scores your app 0–100, and fixes them.

Why this exists

AI writes code that runs. Running is not the same as safe. The gaps that ship in AI-generated apps are boringly predictable — a missing auth check, a table anyone can read, a webhook nobody verifies, a price the client can set — and they don't show up when "everything works."

This plugin runs the checks a senior security engineer would run before launch, in one command, and filters out the false positives that make most AI security reviews useless.

I ship AI-coded products for a living, and the same thing kept happening: the app worked, the demo looked clean — then a real hole showed up after launch. So I built the check I wished I'd run before hitting deploy. On its first real run it flagged a Critical in one of my own databases (a config table left world-writable) that code review had missed. It's now 61 checks across 6 tracks with a 0–100 score, and it grows every release.

Install

In Claude Code (or Cowork), run:

/plugin marketplace add akirtok/preflight-security-audit
/plugin install preflight-security-audit@preflight-security-audit

Installs straight from GitHub — no signup needed.

Use it

/audit                 # audit the whole project
/audit src/app         # audit a subtree
/audit-fix critical    # apply fixes for the Critical findings you approve

Or just say: "Run a preflight security audit on this project."

You get a severity-ranked AUDIT-<date>.md report and a clear BLOCK / FIX-FIRST / GO ship recommendation. Nothing in your code changes without your approval. See a sample report.

What's inside

61 checks across 6 tracks:

What it catches (that "it works" hides)

• A Supabase table with RLS off + public write grants — anyone with the anon key edits your config
• A Stripe webhook accepted without signature verification — anyone can fake a "paid" event
• A price sent from the client and trusted — pay $0.01 for the $99 plan
• An IDOR where changing an ID in the URL returns another user's data
• Prompt injection from user content that reaches your model's instructions
• PII written to logs; a "delete account" that doesn't actually delete

Who it's for

Solo builders and small teams shipping AI-generated apps fast — especially on Next.js + Supabase + Stripe — who want a senior-engineer safety check before they hit deploy.

Roadmap

• CI GitHub Action — audit every PR, block on Critical
• Branded PDF compliance reports (KVKK / GDPR / SOC 2)
• More stack packs (Django, Rails, Go, mobile)

⭐ Star the repo to follow along — new checks land as OWASP and the stacks evolve.

Get new checks by email

New checks ship regularly. Get an email when the important ones land — new Supabase, Stripe, and OWASP coverage — no spam, just the changelog that matters:

👉 Subscribe for updates

Support this project

If it caught something before it bit you, you can sponsor on GitHub or chip in via Stripe — it funds the rule updates that keep it current. (There's a Sponsor button up top too.)

Version history

• v0.3.0 (2026-07-20) — 61 checks. Added client-side/browser-storage, serverless/edge, GraphQL/realtime, modern attacks (Trojan Source), advanced injections, exposed files, bot/DoS, JWT, subdomain takeover, Docker, and security.txt checks; a 0–100 security score; and stack-conditional gating so scans stay fast.
• v0.2.0 (2026-07-18) — 50 checks. First public release. Added the Live Database Advisor & Grant Audit for Supabase/Postgres.
• v0.1.0 (2026-07-15) — Initial 6-track build (security, reliability, performance, AI/LLM, privacy, launch readiness) with the false-positive verifier pass.

Standards

Checks align with OWASP Top 10:2025, the OWASP LLM Top 10, and ASVS 5.0. Actively maintained — new checks land every release.

License

MIT — free to use, fork, and build on.