Upfront: I made this, and part of it is paid. The scanner is free; the $19 kit is the rest. Details below.
When an agent builds the app, it gets the feature working, but the same security gaps keep slipping through: a Supabase service_role key in client code, tables created without row-level security, a Stripe webhook that never verifies the signature, an OpenAI key behind a NEXT_PUBLIC_ prefix.
PreFlight’s scanner is one Node file (166 lines, zero dependencies, Node 18+). Run it in your repo root and nothing gets uploaded. It checks for:
- hardcoded keys (Stripe, OpenAI, Anthropic, xAI, AWS, GitHub, Supabase service_role) and keys in git history
- committed .env files and secrets behind NEXT_PUBLIC_ / VITE_ prefixes
- Supabase migrations without RLS, or with USING (true) policies
- Stripe webhooks with no signature check, LLM calls from the browser
- SQL built from request input, wildcard CORS, raw HTML sinks, no rate limiting
It writes PREFLIGHT-REPORT.md with a fix prompt you can paste straight into Cursor’s agent, and it exits non-zero on criticals, so it can run in CI. It’s pattern matching, so expect some false positives, and it won’t catch logic bugs.
Launch week: code LAUNCH10 takes it from $19 to $9 through Sunday.
Free scanner (read the source first): https://preflight-kit.pages.dev
The paid part ($19 one-time, 7-day refund) is for what a regex can’t see: 12 audit prompts for the agent (who can read whose data, what the server trusts, payments, prompt injection), an always-on Cursor rule (.cursor/rules/security.mdc) plus an AGENTS.md section so the agent stops reintroducing these bugs, a Supabase RLS audit query and policy templates, a 30-point launch checklist and a leaked-key runbook.
I’d like to hear which checks are missing and where it’s noisy on your projects.