{ "id": "secure-before-you-ship", "type": "loadout", "title": "Secure before you ship", "summary": "A launch-check skill and always-on security rules that catch leaked keys, open databases and missing auth before your vibe-coded app goes live.", "description": "Most vibe-coded apps that get burnt at launch fail on the same ten things: a secret key in the\nfront end, a database anyone can read, an admin route with no auth check, or a free API endpoint\nsomeone scripts to run up your bill. This loadout gives your agent a repeatable pre-launch audit\nand a set of rules that stop the worst mistakes being written in the first place.\nStack-agnostic: works for Next.js, Vite, Astro, Express, Flask, Supabase, Firebase and friends.\n", "highlights": [ "Launch-check skill that produces a plain-English, severity-ranked fix list", "Checklist reference covering secrets, auth, data access, abuse, headers and dependencies", "Always-on rule that stops agents hard-coding or logging secrets", "Read-only by design — the skill reports and proposes fixes, it does not rewrite your app unasked" ], "version": "1.0.0", "license": "MIT", "author": { "name": "Agent Loadout", "url": "https://loadout.jnw-it.com" }, "categories": [ "security", "web-app" ], "stacks": [ "any", "javascript", "typescript", "python" ], "files": [ { "path": "AGENTS.md", "role": "instructions", "description": "Security baseline rules for any agent that reads AGENTS.md.", "skill": null, "agent": null, "install_to": { "claude-code": "AGENTS.md", "codex": "AGENTS.md", "cursor": "AGENTS.md", "gemini-cli": "AGENTS.md", "copilot": "AGENTS.md" }, "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/AGENTS.md", "raw_latest_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/latest/AGENTS.md", "bytes": 2212, "lang": "markdown", "content": "# AGENTS.md: security baseline\n\nThese rules apply to every change in this repository, whatever the stack.\n\n## Secrets\n- Never hard-code API keys, tokens, passwords or connection strings. Read them from environment variables.\n- Never put a secret in a variable the browser can see: `NEXT_PUBLIC_*`, `VITE_*`, `PUBLIC_*`, `EXPO_PUBLIC_*`,\n or anything bundled into client JavaScript. If the front end needs a third-party API, call it through a server route.\n- Never log secrets, full request headers, or whole environment objects.\n- Keep `.env`, `.env.local` and similar files out of git. Keep `.env.example` up to date with dummy values.\n- If you find a secret committed to git, stop and tell the human. Deleting the line is not enough —\n it must be rotated with the provider.\n\n## Auth and access\n- Every route, server action and API handler that reads or changes user data checks who the user is *on the server*.\n- Check authorisation on the resource, not just login: \"is this user allowed to touch *this* row?\"\n- Admin features check an admin role stored server-side, never a flag sent by the client.\n- Database access rules (Supabase RLS, Firebase Security Rules, Postgres grants) are the real boundary.\n Do not turn them off to make something work.\n\n## Input and output\n- Validate all input on the server with a schema (zod, valibot, pydantic). Client validation is for UX only.\n- Use parameterised queries or the ORM. Never build SQL with string concatenation.\n- Do not render user content as raw HTML (`dangerouslySetInnerHTML`, `v-html`, `set:html`, `innerHTML`)\n unless it has been sanitised.\n- File uploads: check type and size server-side, store outside the web root or in object storage, never trust the filename.\n\n## Cost and abuse\n- Any endpoint that calls a paid API (LLMs, email, SMS, maps) needs auth or rate limiting, and ideally both.\n- Set spending caps or budget alerts on paid providers where they exist.\n\n## Dependencies\n- Prefer well-known packages. Check that a package name is real and spelled correctly before installing it.\n- Do not add a dependency for something the platform already does.\n\n## When unsure\nAsk the human, or run the `launch-check` skill and report what it finds.\n" }, { "path": "CLAUDE.md", "role": "adapter", "description": "Imports AGENTS.md for Claude Code.", "skill": null, "agent": "claude-code", "install_to": { "claude-code": "CLAUDE.md", "codex": null, "cursor": null, "gemini-cli": null, "copilot": null }, "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/CLAUDE.md", "raw_latest_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/latest/CLAUDE.md", "bytes": 377, "lang": "markdown", "content": "# CLAUDE.md\n\n@AGENTS.md\n\n## Claude Code notes\n- Skills from this loadout live in `.claude/skills/`: `launch-check`. Use them when their description matches the task.\n- Follow AGENTS.md above; where this file and AGENTS.md disagree, AGENTS.md wins.\n\n\n" }, { "path": "GEMINI.md", "role": "adapter", "description": "Imports AGENTS.md for Gemini CLI.", "skill": null, "agent": "gemini-cli", "install_to": { "claude-code": null, "codex": null, "cursor": null, "gemini-cli": "GEMINI.md", "copilot": null }, "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/GEMINI.md", "raw_latest_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/latest/GEMINI.md", "bytes": 378, "lang": "markdown", "content": "# GEMINI.md\n\n@./AGENTS.md\n\n## Gemini CLI notes\n- Skills from this loadout live in `.agents/skills/`: `launch-check`. Use them when their description matches the task.\n- Follow AGENTS.md above; where this file and AGENTS.md disagree, AGENTS.md wins.\n\n\n" }, { "path": ".cursor/rules/no-secrets.mdc", "role": "rules", "description": "Always-on Cursor rule about secrets and environment variables.", "skill": null, "agent": null, "install_to": { "claude-code": null, "codex": null, "cursor": ".cursor/rules/no-secrets.mdc", "gemini-cli": null, "copilot": null }, "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/.cursor/rules/no-secrets.mdc", "raw_latest_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/latest/.cursor/rules/no-secrets.mdc", "bytes": 727, "lang": "markdown", "content": "---\ndescription: Never expose or hard-code secrets\nalwaysApply: true\n---\n\n- Read secrets from environment variables. Never write a real key, token or password into code, tests, docs or examples.\n- Client-exposed prefixes (`NEXT_PUBLIC_`, `VITE_`, `PUBLIC_`, `EXPO_PUBLIC_`) are public. Never put a secret behind one.\n- Calls to paid or secret-key APIs go through server code, never directly from the browser.\n- Never log tokens, cookies, auth headers or whole `process.env` / `os.environ` objects.\n- When adding a variable, add a dummy entry to `.env.example` and make sure `.env*` (except the example) is git-ignored.\n- If you spot a secret already committed, stop and tell the human that it needs rotating with the provider.\n" }, { "path": "skills/launch-check/SKILL.md", "role": "skill", "description": "Runs a pre-launch security and readiness audit.", "skill": "launch-check", "agent": null, "install_to": { "claude-code": ".claude/skills/launch-check/SKILL.md", "codex": ".agents/skills/launch-check/SKILL.md", "cursor": ".agents/skills/launch-check/SKILL.md", "gemini-cli": ".agents/skills/launch-check/SKILL.md", "copilot": ".agents/skills/launch-check/SKILL.md" }, "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/SKILL.md", "raw_latest_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/latest/skills/launch-check/SKILL.md", "bytes": 2631, "lang": "markdown", "content": "---\nname: launch-check\ndescription: Pre-launch security and readiness audit for web apps. Use when the user says they are about to launch, deploy, go live, share the link, or asks \"is my app safe?\".\n---\n\n# Launch check\n\nProduce a plain-English, severity-ranked fix list that a non-expert can act on.\n**Report first. Do not change code until the human picks which fixes to apply.**\n\n## Steps\n\n1. **Map the app (2 minutes, no more).** Identify the framework, where server code runs, the database and\n auth provider, the hosting platform, and every third-party API it calls. Read `package.json` /\n `requirements.txt` / `pyproject.toml`, the env example file, and the routes or API folder.\n\n2. **Work through `references/checklist.md`.** For each item decide: pass, fail, or can't tell.\n Prefer evidence from the code. Useful searches:\n - Secrets in code: `git grep -nE \"(sk_live|sk_test|sb_secret_|service_role|AKIA[0-9A-Z]{16}|ghp_|xox[bp]-|-----BEGIN)\"`\n - Secrets in history: `git log -p --all -S \"sk_live\" | head` (repeat for other patterns that hit)\n - Client-exposed env: `git grep -nE \"(NEXT_PUBLIC_|VITE_|PUBLIC_|EXPO_PUBLIC_)[A-Z_]*(SECRET|PRIVATE|SERVICE|TOKEN)\"`\n - Committed env files: `git ls-files | grep -E \"(^|/)\\.env\"`\n - Raw HTML: `git grep -nE \"dangerouslySetInnerHTML|v-html|set:html|innerHTML\\s*=\"`\n - String-built SQL: `git grep -nE \"(query|execute|raw)\\(.*(\\+|\\$\\{|f\\\")\"`\n - Server routes without an auth check: list every API route and note which ones read the user.\n\n3. **Check the database rules** if there is one. Supabase: every public table has RLS enabled with real\n policies. Firebase: rules are not `allow read, write: if true`. Plain Postgres/MySQL: the app user is not a superuser.\n\n4. **Check abuse and cost.** List every endpoint that triggers a paid API. Note whether it requires auth and is rate limited.\n\n5. **Write the report** in this format:\n\n```\nLaunch check — — \nVerdict: Not ready / Ready with fixes / Ready\n\nCRITICAL (fix before anyone else sees the link)\n1. — \n Why it matters: \n Fix: \n\nHIGH (fix before launch day)\n...\nMEDIUM (fix in the first week)\n...\nCouldn't check: \n```\n\nKeep each finding to three or four lines. Do not pad the report with passes; list passes as a single line count.\n\n6. **Offer the fixes.** Ask which to apply. Rotated keys, dashboard settings and DNS changes are jobs for the\n human — explain exactly where to click, but do not pretend you did them.\n" }, { "path": "skills/launch-check/references/checklist.md", "role": "reference", "description": "The full checklist the launch-check skill works through.", "skill": "launch-check", "agent": null, "install_to": { "claude-code": ".claude/skills/launch-check/references/checklist.md", "codex": ".agents/skills/launch-check/references/checklist.md", "cursor": ".agents/skills/launch-check/references/checklist.md", "gemini-cli": ".agents/skills/launch-check/references/checklist.md", "copilot": ".agents/skills/launch-check/references/checklist.md" }, "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/references/checklist.md", "raw_latest_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/latest/skills/launch-check/references/checklist.md", "bytes": 2783, "lang": "markdown", "content": "# Launch checklist\n\nSeverity in brackets is the default; raise it if the data is sensitive.\n\n## Secrets\n- [Critical] No live secret keys in source code or config files.\n- [Critical] No secrets in client-exposed env vars or the built front-end bundle.\n- [Critical] No `.env` files tracked by git. If one ever was, the keys in it need rotating.\n- [High] Secrets in git history have been rotated (removing the commit is not enough).\n- [Medium] `.env.example` exists and lists every variable with a dummy value.\n\n## Authentication\n- [Critical] Every API route / server action that touches user data checks the session on the server.\n- [Critical] Admin pages and endpoints check a server-side role, not a client flag or a hidden URL.\n- [High] Password reset and magic-link flows expire and are single use (default on most providers — confirm it is not disabled).\n- [Medium] Email confirmation is required before an account can do anything costly.\n\n## Data access\n- [Critical] Database rules are on: Supabase RLS on every public table, Firebase rules not open, no public buckets with private files.\n- [Critical] Users cannot read or change another user's rows by changing an ID in the request (test one by hand).\n- [High] Update endpoints cannot change ownership or role fields.\n- [High] Queries are parameterised; no string-built SQL.\n\n## Abuse and cost\n- [Critical] Endpoints that call paid APIs (LLM, email, SMS) need auth.\n- [High] Those endpoints are rate limited per user or IP.\n- [High] Provider spending limits or budget alerts are set.\n- [Medium] Sign-up has some bot friction (captcha, email confirmation or invite).\n\n## Input and output\n- [High] Server-side validation on every input.\n- [High] No unsanitised user HTML rendered.\n- [Medium] Uploads checked for type and size server-side.\n- [Medium] Error responses do not leak stack traces or SQL.\n\n## Platform\n- [High] HTTPS only. Cookies are `Secure`, `HttpOnly` and `SameSite=Lax` or stricter.\n- [Medium] Security headers set: `Content-Security-Policy` (even a basic one), `X-Content-Type-Options: nosniff`,\n `Referrer-Policy`, `frame-ancestors` / `X-Frame-Options`.\n- [Medium] CORS is not `*` on endpoints that use cookies.\n- [Medium] Debug mode, test routes and seed endpoints are off in production.\n\n## Dependencies\n- [High] `npm audit --omit=dev` / `pip-audit` shows no critical issues in runtime dependencies.\n- [Medium] Lockfile committed.\n- [Medium] No unfamiliar or misspelt packages (check anything you do not recognise on the registry).\n\n## Readiness (not security, but people notice)\n- [Medium] Privacy policy and terms exist if you collect personal data (UK GDPR applies to UK users).\n- [Medium] Error tracking or at least server logs are on.\n- [Medium] Database backups are on and you know how to restore one.\n" } ], "requires": { "tools": [ "git" ], "env": [], "mcp": [] }, "tested": { "status": "untested", "last_run": null, "fixture": null, "per_agent": { "claude-code": "untested", "codex": "untested", "cursor": "untested", "gemini-cli": "untested", "copilot": "untested" } }, "security": { "scanned": true, "scanner": "intake-precheck/1", "verdict": "clean", "network": false, "scripts": [], "notes": "Instructions only. No scripts, no network access required." }, "featured": true, "deprecated": false, "last_checked": "2026-10-15", "published": "2026-10-15", "updated": "2026-10-15", "compatibility": { "claude-code": "native", "codex": "native", "cursor": "native", "gemini-cli": "native", "copilot": "native" }, "counts": { "rules": 2, "skills": 1, "mcp": 0 }, "url": "https://loadout.jnw-it.com/loadouts/secure-before-you-ship/", "api_url": "https://loadout.jnw-it.com/api/loadouts/secure-before-you-ship.json", "verification": { "level": "verified-install", "status": "verified", "label": "Verified install", "verified": true, "checked_at": "2026-10-16T22:54:03Z", "commit": "ad36e852567aa3c87821d2a9e2fe4052fd983374", "content_current": true, "agent_tests": "not-run", "counts": { "pass": 8, "fail": 0, "skip": 0, "not_applicable": 2 }, "meaning": "Level 1: automated checks on the files (parse, install paths, MCP config, safety scan, references, size, licence, starter build). No AI agent was run.", "checks": [ { "id": "listing", "name": "Listing", "status": "pass", "summary": "Schema valid; 6 files declared, none missing or extra", "details": [ "tested.status: untested (agent tests are separate from Level 1)" ] }, { "id": "parse", "name": "Files parse", "status": "pass", "summary": "All 6 files parse; front matter valid", "details": [] }, { "id": "adapters", "name": "Adapters", "status": "pass", "summary": "CLAUDE.md and GEMINI.md import AGENTS.md and are up to date", "details": [ "CLAUDE.md: matches the generator", "GEMINI.md: matches the generator" ] }, { "id": "install-paths", "name": "Install paths", "status": "pass", "summary": "Correct paths for all 5 agents; layouts re-discovered", "details": [ "Claude Code: 4 files, 1 skill in .claude/skills/", "Codex CLI: 3 files, 1 skill in .agents/skills/", "Cursor: 4 files, 1 skill in .agents/skills/, 1 rule", "Gemini CLI: 4 files, 1 skill in .agents/skills/", "GitHub Copilot: 3 files, 1 skill in .agents/skills/" ] }, { "id": "mcp", "name": "MCP config", "status": "n/a", "summary": "No MCP servers in this loadout", "details": [] }, { "id": "safety", "name": "Safety scan", "status": "pass", "summary": "Clean: no credentials, risky shell or hidden text", "details": [ "Scanner intake-precheck/1: verdict clean; network no (listing says no)" ] }, { "id": "references", "name": "References", "status": "pass", "summary": "2 references between files resolve for every agent", "details": [] }, { "id": "size", "name": "Size limits", "status": "pass", "summary": "6 files, 8.9 KB total; largest skills/launch-check/references/checklist.md 2.7 KB", "details": [ "Limits: 30 files, 32 KB per file, 128 KB total, 500 lines per skill or rule" ] }, { "id": "licence", "name": "Licence", "status": "pass", "summary": "MIT, by Agent Loadout; text in the repository LICENSE", "details": [] }, { "id": "starter-build", "name": "Starter build", "status": "n/a", "summary": "Not applicable: stack-agnostic security rules with no project or code to build", "details": [ "The loadout is working rules and a checklist for any stack; there is no starter project or code example to compile.", "Every other Level 1 check still runs on this loadout." ] } ] }, "install": { "claude-code": { "files": [ { "path": "AGENTS.md", "target": "AGENTS.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/AGENTS.md", "role": "instructions" }, { "path": "CLAUDE.md", "target": "CLAUDE.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/CLAUDE.md", "role": "adapter" }, { "path": "skills/launch-check/SKILL.md", "target": ".claude/skills/launch-check/SKILL.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/SKILL.md", "role": "skill" }, { "path": "skills/launch-check/references/checklist.md", "target": ".claude/skills/launch-check/references/checklist.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/references/checklist.md", "role": "reference" } ], "manual_steps": [], "zip_url": "https://loadout.jnw-it.com/download/secure-before-you-ship/claude-code.zip" }, "codex": { "files": [ { "path": "AGENTS.md", "target": "AGENTS.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/AGENTS.md", "role": "instructions" }, { "path": "skills/launch-check/SKILL.md", "target": ".agents/skills/launch-check/SKILL.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/SKILL.md", "role": "skill" }, { "path": "skills/launch-check/references/checklist.md", "target": ".agents/skills/launch-check/references/checklist.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/references/checklist.md", "role": "reference" } ], "manual_steps": [], "zip_url": "https://loadout.jnw-it.com/download/secure-before-you-ship/codex.zip" }, "cursor": { "files": [ { "path": "AGENTS.md", "target": "AGENTS.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/AGENTS.md", "role": "instructions" }, { "path": ".cursor/rules/no-secrets.mdc", "target": ".cursor/rules/no-secrets.mdc", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/.cursor/rules/no-secrets.mdc", "role": "rules" }, { "path": "skills/launch-check/SKILL.md", "target": ".agents/skills/launch-check/SKILL.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/SKILL.md", "role": "skill" }, { "path": "skills/launch-check/references/checklist.md", "target": ".agents/skills/launch-check/references/checklist.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/references/checklist.md", "role": "reference" } ], "manual_steps": [], "zip_url": "https://loadout.jnw-it.com/download/secure-before-you-ship/cursor.zip" }, "gemini-cli": { "files": [ { "path": "AGENTS.md", "target": "AGENTS.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/AGENTS.md", "role": "instructions" }, { "path": "GEMINI.md", "target": "GEMINI.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/GEMINI.md", "role": "adapter" }, { "path": "skills/launch-check/SKILL.md", "target": ".agents/skills/launch-check/SKILL.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/SKILL.md", "role": "skill" }, { "path": "skills/launch-check/references/checklist.md", "target": ".agents/skills/launch-check/references/checklist.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/references/checklist.md", "role": "reference" } ], "manual_steps": [], "zip_url": "https://loadout.jnw-it.com/download/secure-before-you-ship/gemini-cli.zip" }, "copilot": { "files": [ { "path": "AGENTS.md", "target": "AGENTS.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/AGENTS.md", "role": "instructions" }, { "path": "skills/launch-check/SKILL.md", "target": ".agents/skills/launch-check/SKILL.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/SKILL.md", "role": "skill" }, { "path": "skills/launch-check/references/checklist.md", "target": ".agents/skills/launch-check/references/checklist.md", "raw_url": "https://loadout.jnw-it.com/raw/secure-before-you-ship/1.0.0/skills/launch-check/references/checklist.md", "role": "reference" } ], "manual_steps": [], "zip_url": "https://loadout.jnw-it.com/download/secure-before-you-ship/copilot.zip" } }, "source_zip_url": "https://loadout.jnw-it.com/download/secure-before-you-ship/source.zip" }