What does Launch Audit check?

28 checks across leaked keys, auth, Row Level Security, Stripe and hardening: for example live Stripe keys in code, secrets in NEXT_PUBLIC_ variables, getSession() on the server, tables without RLS, using (true) policies, unsigned webhooks and access granted on the success page. An AI auditor then verifies each hit and runs 10 manual checks such as IDOR and ownership on updates.

Will it change my code?

No. The auditor has no file-editing tools and redacts any secret it finds. A separate /audit-fix-plan command walks you through fixes one approved change at a time.

Yes. It includes a zero-dependency scanner you can run in CI with --fail-on=high.

Is this a penetration test?

No. It is static analysis plus AI review, not a penetration test.

All 28 checks are proven on a deliberately vulnerable app in the included test suite, and the scanner reports 0 findings on a clean reference app.

LAUNCH AUDIT · NEXT.JS + SUPABASE + STRIPE · $12

One command before you launch: audit your Next.js + Supabase + Stripe app

28 checks across keys, auth, RLS, Stripe, and hardening. An auditor subagent with no file-editing tools then verifies every hit, discards false positives, and runs 10 manual checks. You get LAUNCH-AUDIT.md with a verdict, a scorecard, and every issue at file:line with its fix.

Get Launch Audit for $1.30 (UK $1.56 incl. VAT) · first 10 buyers

then $12 · ends 28 Oct, 18:59 UK or after 10 sales

Get the free 20-check checklist it automates

One-off payment via Gumroad. Prices exclude VAT; UK and EU VAT is added at Gumroad checkout.

Launch Audit: 28 checks for secrets, auth, RLS and Stripe; AI auditor (no file-editing tools) verifies hits; writes LAUNCH-AUDIT.md

What it checks

Keys: live Stripe keys in code, secrets in NEXT_PUBLIC_, service role in client components, .env in git
Auth: getSession() on the server, Server Actions without auth checks, open redirects, admin client misuse, roles in user_metadata
RLS: tables without RLS, using (true), anon writes, missing with check, unsafe security definer, views that bypass RLS
Stripe: unsigned webhooks, JSON parsed before verification, no idempotency, client-chosen prices, access granted on the success page
Hardening: unvalidated input, leaked error messages, missing security headers, dangerouslySetInnerHTML

Why it's more than a scan

More than a linter. The auditor opens each flagged line and checks for IDOR, ownership on updates, webhook user mapping, subscription logic, and storage policies.
Fixes in order. /audit-fix-plan handles secrets first, one approved change at a time.
Safe to run. The auditor has no file-editing tools and redacts any secret it finds.
Runs in CI. A zero-dependency scanner with --fail-on=high.

Proof

All 28 checks are proven on a deliberately vulnerable app, and the scanner reports 0 findings on a clean reference app. The test suite is included, so you can rerun both.

What this doesn't do

It isn't a penetration test. It's static analysis plus AI review.
It doesn't edit your code during the audit. Fixes happen only through /audit-fix-plan, with your approval.
It covers Next.js + Supabase + Stripe only.

Not affiliated with Anthropic, Supabase, Stripe.

Price

LAUNCH AUDIT

Launch Audit

One command before you launch.

$12

one-off

28 stack-specific checks + 10 manual auditor checks
LAUNCH-AUDIT.md: verdict, scorecard, file:line fixes
Claude Code plugin + copy-in skills and agent
Cursor/Codex version (Agent Skills)
Zero-dependency CI scanner (--fail-on=high)
Report template, check reference, sample report, test suite

Get Launch Audit

Sold via Gumroad (merchant of record)

Find it before your users do

Get Launch Audit: $12

FAQ

What does Launch Audit check?: 28 checks across leaked keys, auth, Row Level Security, Stripe and hardening: for example live Stripe keys in code, secrets in NEXT_PUBLIC_ variables, getSession() on the server, tables without RLS, using (true) policies, unsigned webhooks and access granted on the success page. An AI auditor then verifies each hit and runs 10 manual checks such as IDOR and ownership on updates.
Will it change my code?: No. The auditor has no file-editing tools and redacts any secret it finds. A separate /audit-fix-plan command walks you through fixes one approved change at a time.
Can I run it in CI?: Yes. It includes a zero-dependency scanner you can run in CI with --fail-on=high.
Is this a penetration test?: No. It is static analysis plus AI review, not a penetration test.
How accurate is it?: All 28 checks are proven on a deliberately vulnerable app in the included test suite, and the scanner reports 0 findings on a clean reference app.