# PreFlight: free local security scanner for Cursor-built apps (plus a paid $19 kit, disclosed upfront)

**URL:** <https://forum.cursor.com/t/preflight-free-local-security-scanner-for-cursor-built-apps-plus-a-paid-19-kit-disclosed-upfront/176253>\
**Category:** Built for Cursor\
**Tags:** security\
**Created:** [October 26, 2026, 4:33pm UTC](https://forum.cursor.com/t/preflight-free-local-security-scanner-for-cursor-built-apps-plus-a-paid-19-kit-disclosed-upfront/176253 "2026-10-26T16:33:43Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![PreFlightKit](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@PreFlightKit](https://forum.cursor.com/u/PreFlightKit)\
**Post date:** [October 26, 2026, 4:33pm UTC](https://forum.cursor.com/t/preflight-free-local-security-scanner-for-cursor-built-apps-plus-a-paid-19-kit-disclosed-upfront/176253/1 "2026-10-26T16:33:43Z")

</div>

Upfront: I made this, and part of it is paid. The scanner is free; the $19 kit is the rest. Details below.

When an agent builds the app, it gets the feature working, but the same security gaps keep slipping through: a Supabase service\_role key in client code, tables created without row-level security, a Stripe webhook that never verifies the signature, an OpenAI key behind a NEXT\_PUBLIC\_ prefix.

PreFlight’s scanner is one Node file (166 lines, zero dependencies, Node 18+). Run it in your repo root and nothing gets uploaded. It checks for:

- hardcoded keys (Stripe, OpenAI, Anthropic, xAI, AWS, GitHub, Supabase service\_role) and keys in git history
- committed .env files and secrets behind NEXT\_PUBLIC\_ / VITE\_ prefixes
- Supabase migrations without RLS, or with USING (true) policies
- Stripe webhooks with no signature check, LLM calls from the browser
- SQL built from request input, wildcard CORS, raw HTML sinks, no rate limiting

It writes PREFLIGHT-REPORT.md with a fix prompt you can paste straight into Cursor’s agent, and it exits non-zero on criticals, so it can run in CI. It’s pattern matching, so expect some false positives, and it won’t catch logic bugs.

Launch week: code LAUNCH10 takes it from $19 to $9 through Sunday.

Free scanner (read the source first): [https://preflight-kit.pages.dev](https://preflight-kit.pages.dev)

The paid part ($19 one-time, 7-day refund) is for what a regex can’t see: 12 audit prompts for the agent (who can read whose data, what the server trusts, payments, prompt injection), an always-on Cursor rule (.cursor/rules/security.mdc) plus an AGENTS.md section so the agent stops reintroducing these bugs, a Supabase RLS audit query and policy templates, a 30-point launch checklist and a leaked-key runbook.

I’d like to hear which checks are missing and where it’s noisy on your projects.

---

<div class="post-metadata">

**Author:** ![PreFlightKit](https://avatars.discourse-cdn.com/v4/letter/p/57b2e6/32.png) [@PreFlightKit](https://forum.cursor.com/u/PreFlightKit)\
**Post date:** [October 29, 2026, 5:19pm UTC](https://forum.cursor.com/t/preflight-free-local-security-scanner-for-cursor-built-apps-plus-a-paid-19-kit-disclosed-upfront/176253/5 "2026-10-29T17:19:09Z")

</div>

Follow-up: I wrote up the 7 manual checks the scanner can’t do for you (logged-out anon-key query, the user A/B replay, the webhook signature test, /.env 404s, AI spend caps), all copy-paste commands: [The 10-minute security check before you launch a vibe-coded app (Supabase + Stripe) - DEV Community](https://dev.to/agentk_6588bb59c6339/the-10-minute-security-check-before-you-launch-a-vibe-coded-app-supabase-stripe-40n1)