PreFlight Repo Risk Report

Example finding

Missing RLS on a sensitive webhook table.

This is the kind of launch-blocking drift the report is built to surface: a migration creates a table for sensitive webhook payloads, but the AI-generated schema forgets the explicit row-level security boundary.

File pathsupabase/migrations/create_webhook_events.sql

SeverityHard Block

Fix directionEnable RLS, add scoped policies, and block direct client access.

Before - AI drift

create table public.webhook_events (
  id uuid primary key,
  provider text not null,
  payload jsonb not null,
  created_at timestamptz default now()
);

-- missing explicit RLS boundary

After - fix direction

alter table public.webhook_events
  enable row level security;

create policy "internal webhook review only"
  on public.webhook_events
  for select
  using (auth.jwt() ->> 'role' = 'admin');

Launch risk

The decision point before an AI-built repo goes live.

The dangerous mistakes are usually boring: missing RLS, exposed server secrets, unsafe routes, weak webhook boundaries, and client/server leaks. PreFlight turns that uncertainty into a short verified launch call.

Launch decision layer

Find the one issue that should stop launch, not fifty warnings to ignore.

Cursor, Claude, Lovable, Bolt, Next.js, Vercel, and Supabase can move an MVP to production quickly. The report focuses on the file paths and boundary failures that matter before real users, billing, or customer data enter the system.

Input Submit the repo

Private review scope, one codebase, launch-blocking security risks.

Review Scan plus manual verification

PreFlight finds candidates, then the top findings are checked by hand.

Output Fix the first real blocker

Exact file path, severity, why it matters, and fix direction.

Designed for the moment when a founder or agency needs a yes/no launch answer, not another raw scanner export.

Severity signal system

PreFlight does not turn every warning into panic. The report separates hard launch blockers from drift and passing checks.

Hard Block

Red. Stop the launch path until the finding is reviewed or fixed.

High Risk Drift

Yellow. Architecture or policy drift that can become a real boundary failure.

Pass

Green. The scanned boundary is present, scoped, and safe enough to move on.

supabase/migrations/create_webhook_events.sql Sensitive table without explicit RLS boundary

Hard Block

app/api/billing/webhook/route.ts Signature and token handling need manual review

High Risk Drift

app/(dashboard)/layout.tsx Server-only guard present before customer data load

Pass

Private report

What lands in your inbox.

A short, private review package built for founders, agencies, and builders who want a verified answer fast without setting up or interpreting a tool themselves.

PreFlight Repo Risk Report includes:

1 repo review
1 PreFlight scan
Top 5 manually verified findings
Exact file paths
Severity rating
Why it matters
Fix direction
Delivered in 48-72 hours
1 month of PreFlight Pro included

Primary offer

Best for founders, agencies, and devs who want a verified answer fast without setting up or interpreting a tool themselves.

$49 global / ₹2,999 India

Order $49 Repo Risk Report See sample report

If I do not find at least one useful, verified issue, you get a full refund. No scanner noise.

Only 10 reports available this week so each review stays manually verified.

This is not a full pentest. It is a focused AI-code security risk review for common launch-blocking mistakes.

Risk domains

What PreFlight checks.

The scanner and manual review focus on the places AI coding agents most often break production architecture.

Supabase

RLS gaps

Policies, predicates, and drift between schema and assumptions.

Secrets

Exposed secrets

Service keys, tokens, and env boundaries moving into client-visible code.

Next.js

Unsafe API routes

Handlers that trust client state or expose privileged actions.

Boundary

Client/server leaks

Private data, server actions, and environment assumptions crossing into browser code.

Auth

Risky auth flows

Session, role, callback, and middleware logic that breaks on edge cases.

Webhooks

Token handling

Unverified signatures, raw payload storage, and direct client access risks.

Runtime

Injection and path risks

Dynamic queries, unchecked input, and unsafe server-side path handling.

Supply chain

Dependency risks

Package and workflow risks that can block a clean launch or handoff.

Review workflow

From repo to report in five steps.

The review stays focused: submit the repo, let PreFlight scan it, then receive a short verified report instead of a giant scanner export.

Submit your repo

Share the repo access path needed for the private review.

PreFlight scans it

The scanner checks repo structure, Supabase policies, API routes, auth flows, and dependency signals.

I manually verify the top risks

The report removes noise and highlights the issues useful to fix before launch.

You receive the private report

Each finding includes exact file path, severity, why it matters, and fix direction.

Keep PreFlight running with Pro

The report includes 1 month of PreFlight Pro so local protection keeps running after the review.

Built for

For teams moving from demo to users.

PreFlight is for fast-shipping repos where AI accelerated the build, but real customers, auth, billing, or tenant data now make security mistakes expensive.

AI MVP agencies

Catch client-facing risks before handoff or launch-week deploys.

SaaS founders

Know what to fix before inviting real users or taking payments.

Dev shops

Add a lightweight security review to AI-assisted delivery.

Non-technical founders

Get a private, readable report without interpreting scanner output.

Vibecoders with users

Cursor, Claude, Lovable, Bolt, Vercel, Next.js, and Supabase projects that are past the toy stage.

Sample report preview

Concrete risk evidence for repo decisions.

Every finding has enough context to decide whether to fix now, investigate, or accept the risk.

High Risk Drift

Webhook events table can be queried by authenticated clients.

File path

supabase/migrations/create_webhook_events.sql

Evidence

The migration creates a table that stores raw webhook payloads but does not enable row level security or add scoped policies.

Why it matters

Webhook payloads can include customer identifiers, billing metadata, and auth-linked data. A public or weakly scoped table becomes a data boundary failure.

Fix direction

Enable RLS, add service-role-only insert path, scoped read policies for internal admin use, and block direct client access.

create table public.webhook_events (
  id uuid primary key,
  provider text not null,
  payload jsonb not null,
  created_at timestamptz default now()
);

-- missing: alter table public.webhook_events enable row level security;
-- review: direct client access should not be possible

Three product paths

Report first. Product protection after.

The report is the done-for-you offer. The product keeps running locally after the report so the same mistakes do not return.

CLI-first

The Eye local daemon

npm install -g preflight-pro
preflight start

The Eye background daemon watches risky edits, terminal hard-blocks catch dangerous changes, and a native Windows popup fallback keeps warnings visible.

IDE-first

VS Code / Cursor Companion

Red squiggles, status bar alerts, IDE popups, and Fix with PreFlight AI surface risk while the developer is still in the editor.

Status bar

PreFlight: 2 high - 4 warning - RLS drift

Agent-first

MCP tools for guarded agents

preflight install-mcp
preflight mcp

MCP tools include scan_project, preflight_fix, and audit_dependencies so agents can ask PreFlight before touching sensitive paths.

Free starter setup

Run local protection before buying anything.

Free users get unlimited local scans plus 10 AI fix credits total. It is built for checking repo risk locally before CI, handoff, or production deploy.

$ preflight start
The Eye daemon online
local scans: unlimited
AI fix credits: 10 total
IDE alerts: enabled
MCP scan support: enabled

After the report

Use the findings, then keep the guardrail on.

The Repo Risk Report is the offer. PreFlight Pro access is included for one month so you can verify the fixes locally and keep The Eye watching future AI-generated changes.

Included free

Local guardrail

Unlimited local scans
Terminal/editor hard blocks
The Eye daemon
VS Code Companion alerts
MCP scan support
10 AI fix credits

Included with report

1 month PreFlight Pro

Unlimited local scans
Pro fix access during the review window
VS Code Companion
MCP integration
Local verification after fixes

Manual review

What I verify

Top 5 useful findings
Exact file paths and severity
Why each issue matters
Fix direction, not raw scanner noise
Refund if nothing useful is verified

Auto-fix

Fix direction first. AI remediation second.

PreFlight AI fix credits are for targeted remediation, not broad rewrite prompts. The system starts from a verified finding and produces a fix path you can review.

$ preflight_fix PF-RLS-014 --mode guarded
patch prepared
review required: yes
changes: supabase/policies/invoices.sql

$ preflight ci --block high
scan: complete
critical: 0
high: 1
warning: 5
blocked: unsafe API route requires review
file: app/api/admin/users/route.ts

Dashboard and CI

Use team workflows when the repo becomes a shared surface.

Team usage adds shared rule packs, reports, pre-commit workflows, CI blocking, and multi-repo visibility without abstract reporting surfaces.

CI/pre-commit workflows for high-risk changes
Team reports for agencies and dev shops
Shared config for multiple repos

FAQ

Focused, private, and clear about scope.

PreFlight is designed to catch common AI-code security mistakes before launch. It does not pretend to replace a full security program.

Is this a full pentest?

No. The Repo Risk Report is a focused AI-code security risk review for common launch-blocking mistakes. It is designed to find useful issues quickly, not certify the entire system.

What do I receive?

A short private report with the top 5 manually verified findings, exact file paths, severity, why each issue matters, and fix direction.

What stacks are best suited?

PreFlight is positioned for AI-built Next.js, Supabase, Vercel, Cursor, Lovable, Bolt, and Claude-assisted repos, especially projects moving from MVP to real users.

What if no useful issue is found?

If I do not find at least one useful, verified issue, you get a full refund. No scanner noise.

Can I keep using PreFlight after the report?

Yes. The report includes 1 month of PreFlight Pro, and free users can keep unlimited local scans plus 10 AI fix credits total.