You vibe-coded an app. Everything works. But is it safe to ship?
A one-command, 61-check pre-ship audit for AI-coded apps — security, reliability, performance, AI/LLM, privacy, and launch readiness — that finds the vulnerabilities, scores your app 0–100, and fixes them.
AI writes code that runs. Running is not the same as safe. The gaps that ship in AI-generated apps are boringly predictable — a missing auth check, a table anyone can read, a webhook nobody verifies, a price the client can set — and they don't show up when "everything works."
This plugin runs the checks a senior security engineer would run before launch, in one command, and filters out the false positives that make most AI security reviews useless.
I ship AI-coded products for a living, and the same thing kept happening: the app worked, the demo looked clean — then a real hole showed up after launch. So I built the check I wished I'd run before hitting deploy. On its first real run it flagged a Critical in one of my own databases (a config table left world-writable) that code review had missed. It's now 61 checks across 6 tracks with a 0–100 score, and it grows every release.
In Claude Code (or Cowork), run:
/plugin marketplace add akirtok/preflight-security-audit
/plugin install preflight-security-audit@preflight-security-audit
Installs straight from GitHub — no signup needed.
/audit # audit the whole project
/audit src/app # audit a subtree
/audit-fix critical # apply fixes for the Critical findings you approve
Or just say: "Run a preflight security audit on this project."
You get a severity-ranked AUDIT-<date>.md report and a clear
BLOCK / FIX-FIRST / GO ship recommendation. Nothing in your code changes
without your approval. See a sample report.
61 checks across 6 tracks:
| Track | Focus |
|---|---|
| 🧬 Code Core | injection, auth, IDOR, secrets, error handling, races, N+1, memory, transactions, tests |
| 🕸️ Web/App Security | XSS, CSRF, SSRF, headers/CORS/TLS, crypto, file upload, rate limiting, Supabase RLS, live-DB grant audit, client-side storage, serverless/edge, GraphQL, Trojan Source & modern attacks, JWT |
| 🤖 AI/LLM Security | prompt injection (direct + indirect), output handling, sensitive disclosure, excessive agency |
| 🔒 Privacy & Compliance | PII inventory, GDPR/KVKK consent, cookies, retention & deletion, legal pages |
| 🚀 Launch Readiness | accessibility, SEO, Core Web Vitals, monitoring, backups, CI/CD, Stripe billing correctness, subdomain takeover, Docker |
| ✅ Verification | re-checks every finding, rejects anything it can't prove, calibrates severity, scores 0–100 |
- A Supabase table with RLS off + public write grants — anyone with the anon key edits your config
- A Stripe webhook accepted without signature verification — anyone can fake a "paid" event
- A price sent from the client and trusted — pay $0.01 for the $99 plan
- An
IDORwhere changing an ID in the URL returns another user's data - Prompt injection from user content that reaches your model's instructions
- PII written to logs; a "delete account" that doesn't actually delete
Solo builders and small teams shipping AI-generated apps fast — especially on Next.js + Supabase + Stripe — who want a senior-engineer safety check before they hit deploy.
- CI GitHub Action — audit every PR, block on Critical
- Branded PDF compliance reports (KVKK / GDPR / SOC 2)
- More stack packs (Django, Rails, Go, mobile)
⭐ Star the repo to follow along — new checks land as OWASP and the stacks evolve.
New checks ship regularly. Get an email when the important ones land — new Supabase, Stripe, and OWASP coverage — no spam, just the changelog that matters:
If it caught something before it bit you, you can sponsor on GitHub or chip in via Stripe — it funds the rule updates that keep it current. (There's a Sponsor button up top too.)
- v0.3.0 (2026-07-20) — 61 checks. Added client-side/browser-storage, serverless/edge, GraphQL/realtime, modern attacks (Trojan Source), advanced injections, exposed files, bot/DoS, JWT, subdomain takeover, Docker, and security.txt checks; a 0–100 security score; and stack-conditional gating so scans stay fast.
- v0.2.0 (2026-07-18) — 50 checks. First public release. Added the Live Database Advisor & Grant Audit for Supabase/Postgres.
- v0.1.0 (2026-07-15) — Initial 6-track build (security, reliability, performance, AI/LLM, privacy, launch readiness) with the false-positive verifier pass.
Checks align with OWASP Top 10:2025, the OWASP LLM Top 10, and ASVS 5.0. Actively maintained — new checks land every release.
MIT — free to use, fork, and build on.