0xwilliamortiz
Featured
ponytail-improved
Ponytail is a plugin for AI coding agents that enforces a disciplined ladder of reuse before writing code, reducing code volume by roughly 54% while preserving safety.
AI repository intelligence
FR-AI / ANALYSISWhy it is worth attention
It fills a critical gap for non-security-aware developers who use AI coding tools, providing a structured, stack-aware audit that argues back against rationalizations, uses fixed rubrics for consistent scoring, and includes evidence-based interviews rather than simple self-reporting.
Who it is for
- Developers who built apps with Lovable, Bolt, v0, Cursor, or Claude Code and lack security background
- Indie hackers and solo founders shipping their first production app
- Junior developers who don't know what they don't know about production hardening
- Teams wanting a repeatable, stack-aware pre-launch security checklist
Use cases
- Production readiness check before launching an AI-built web app
- Security hardening audit for Supabase, Firebase, or Next.js apps
- Post-development review to catch common expensive gaps like disabled RLS or missing rate limiting
- Iterative scoring loop to track progress from 0/5 to 5/5 domains passing
Strengths
- Stack-agnostic with auto-detection of framework and backend (Next.js, Supabase, Firebase, Prisma, etc.)
- Provides copy-paste fix playbooks for major gaps like RLS policies, rate limiters, and security headers
- Fixed, repeatable rubric across 5 domains with critical/high/medium/low severity, unlike free-form AI reviews
- Evidence-based interview phase that requires command output rather than user attestation, and refuses to mark unverifiable items as passing
Considerations
- Requires Claude Code environment (terminal with Claude CLI) and manual git setup to run the audit
- Cannot automatically fix secrets, database settings, or DNS; these require user-manual steps
- Not a penetration test – passing all domains means not an easy target, not unhackable
README quick start
launchworthy
A Claude Code skill that plays bouncer at the door of production. Your app doesn't get in front of real users until it passes the check.
You built an app with Lovable, Bolt, v0, Cursor, or Claude Code. It works on your screen. This audits the five domains between "works for me" and "real users are paying for this and nothing is on fire," gives you a scored scorecard, and hands you a prioritized punch list with exact file paths and copy-paste fixes. The scorecard answers one question: is this app launchworthy yet?
It is stack-agnostic. It auto-detects your framework (Next.js, TanStack Start, SvelteKit, Svelte, Vite + React, Astro, Remix, and more) and your backend (Supabase, Firebase, Prisma, Directus, raw SQL) and adapts every check to what you actually use.
Why not just ask Claude?
The fair first question, so it goes first. Claude already knows what RLS is, what a rate limiter looks like, and why secrets do not belong in a client bundle. The knowledge was never the gap. What a raw "review my code" session does not give you:
- The scope you did not know to ask for. "Review my code" gets you a code review. It will not ask whether your backups have ever been restore-tested, whether error alerts actually reach you, whether you can roll back a bad deploy, or whether your domain registrar has 2FA. A third of this checklist is not in the code at all, and the person who most needs the audit is exactly the person who does not know to ask for those parts.
- A reviewer that refuses to reassure you. A chat model's default is to be agreeable. This skill's contract is not: anything it cannot verify is
MANUAL CHECK NEEDED, never a pass. A domain whose critical check is unverified is capped at WARN. Your own "yes, that's fine" is recorded asreported by user, unverified; it never turns green on its own. And when you say "it's just an MVP," it argues back instead of nodding along. - The same rubric twice. Ask a model to review your app twice and you get two differently shaped reviews. The fixed checklist, severities, and scoring rules are what make "0/5, fix the blockers, 5/5" a real progression you can watch, instead of vibes that shift every run.
- Judgment calls settled in advance. Generic AI reviews routinely flag the Supabase anon key
Description
A Claude Code skill that plays bouncer at the door of production: audits AI-built apps (Lovable, Bolt, v0, Cursor) across 5 domains and hands you a scored punch list with copy-paste fixes. MIT.
Related repositories
Similar projects matched by category, topics, and programming language.
AgriciDaniel
Featured
anti-slop
Anti-slop is a tool for detecting and repairing substance defects in AI-assisted prose, code, documentation, and agent output using deterministic scanners and structural procedures that produce verifiable artifacts rather than authorship judgments.
makecindy
Featured
cindy
Cindy is an open-source AI agent that runs locally on your machine, integrates multiple AI harnesses and models, and provides memory, skills, and automation to perform real work in your projects and apps.