PreFlight
An educational audit tool for vibers building vibeware.
Flying blind is bad. PreFlight handles the safety checks, so we can all fly with confidence.
Free, in-browser static security audit for apps built with AI coding tools (Lovable, Cursor, Bolt, Replit, Claude Code, v0, GitHub Copilot) and any other web application.
No signup. No backend. No analytics beacons. All scanning runs in your browser tab and stays there. Nothing leaves your machine.
What it does
PreFlight catches what your AI probably missed: exposed secrets, misconfigured RLS, supply-chain compromises, unprotected admin routes. Then we explain each finding so you can learn why it matters and how to avoid it in the future. All scanning runs locally in your browser. Nothing leaves your machine. Ever.
How it works
PreFlight is a free in-browser security audit for AI-built apps. Open the page, point it at your code, read what it found, fix what matters. Nothing leaves your machine. The three ways to scan:
- GitHub URL. The browser fetches the public source directly from raw.githubusercontent.com. Private repos use a token you provide in Settings; it goes to GitHub, never to us.
- Local folder. Pick a directory. The File API reads it in the tab. The bytes never upload anywhere.
- Paste. Drop a single file or snippet in for a quick look.
What every finding carries (result schema)
Every finding carries severity (critical / high / medium / low / info), CWE, file:line, evidence, remediation, confidence tag (high / medium / heuristic), and autofix tag (mechanical / review-needed / manual). Every finding also carries the OWASP category code(s) it maps to.
What it is not
- Static analysis only. It does not run your code or probe your endpoints.
- Not a certification, an SBOM, or a license tool. Those exist elsewhere.
- Not a replacement for professional review. It catches the class of failure someone assumed was already being watched.
Read more
- How it works — the full tour: scanning, reading a finding, scoped coverage, the compliance lens.
- Learn — the patterns, field reports on named incidents, OWASP coverage map, glossary.
- OWASP coverage · Privacy · Terms
OWASP Top 10 2025 + OWASP LLM Top 10 2025 · Free, no signup · Code MIT, threat-intel data CC-BY-4.0 · [email protected]