The launch check

The launch check reads a public GitHub repository, or a .zip of your app's code, and tells you what would go wrong in production. It's free, needs no account, and works whether or not you deploy with Launchpad. It also runs on your computer, from the command line or an AI agent (see below).

What it looks for

Security

• Keys committed to the repository: a real .env, a Stripe or Supabase key in code, a private key file. It reports the file and line, never the value.
• Secrets behind a browser-visible prefix (NEXT_PUBLIC_, VITE_, PUBLIC_), which ship to every visitor.
• Payment webhooks that don't verify their signature, so anyone could post a fake "payment succeeded".
• Supabase tables created without row-level security, and policies that turn it back off for writes (using (true) on an insert, update or delete).
• Missing security headers.

The holes AI-built apps ship with

Code written by Lovable, Bolt, Cursor or v0 tends to work in every test and still leave these open:

• The Supabase service-role key in browser code. It skips every security rule, so anyone who opens the app can read, change or delete the whole database.
• Firebase rules that let anyone write, including the test-mode rules that open everything until a date and then stop the app working.
• An AI key sent to the browser (dangerouslyAllowBrowser).
• Endpoints that change data without checking who's asking: routes and server actions that write to the database with no sign-in check, and no middleware doing it for them.
• Admin pages with no sign-in check.
• AI endpoints with no rate limit, which a bot can call in a loop at your expense.

These are read from the code, never tested against your live app: the check runs on any public repository, so it must not be usable against someone else's database. Examples, tests and fixtures are skipped.

Launch

• Environment variables used in code but missing from .env.example, the usual cause of a deploy that builds and then crashes.
• No health route, no lockfile, a build script that can't run in CI.
• Bot protection missing on a public form.

What breaks when the app leaves the tool that built it

The check recognises an app built with Lovable, Bolt, v0 or Replit, says so, and looks for what worked inside the tool and won't outside it:

• Pages that 404. A single-page app (React Router, Wouter) built to plain files, with no vercel.json rewrite, _redirects or Netlify redirect: opening /dashboard directly shows a 404.
• A server-rendered app built for one host. A TanStack Start app (Lovable's default since May 2026) set up for Cloudflare Workers or Netlify, or for no host at all, can't run on Vercel or a Node server. Set up with Nitro, it can.
• Imports with the wrong capital letters, which build on a Mac and fail on Linux.
• Replit's own sign-in and storage, which only exist on Replit, and a server fixed to one port.
• Lockfiles from two package managers, so the host may install different versions.

Fix it with your AI tool

If you built the app with an AI tool, you fix it the same way. Every finding to fix has a Copy fix request button: a request with what's wrong, where, and how to fix it, written for the tool that wrote the code. Copy a request for all puts every finding in one request, most important first. Paste it into Lovable, Bolt, v0, Replit or Cursor, let it make the changes, and run the check again.

A request never holds a key's value (the report doesn't either), and it tells the tool to list anything that has to be done outside the code, such as revoking a leaked key, rather than skip it.

Email

With a domain, it checks SPF, DMARC and Resend's DKIM record, and whether the domain can receive replies.

The score

Each finding carries a weight: something that must be fixed before launch costs more than something worth fixing. The score starts at 100 and goes down from there.

Score	Label
90–100	Launch-ready
60–89	Almost there
below 60	Needs work

Every finding says what it is, why it matters and how to fix it, and those Launchpad would handle for you are marked.

Sharing it

• The results page has its own link, which re-runs the check on the latest code, so it's always current.
• The README badge shows the score and links back to the full results:

[![Launch check](https://launchpad.axonscape.com/api/badge/owner/repo)](https://launchpad.axonscape.com/check?repo=owner/repo)

The badge contains only the score, never anything read from your code.

Private repositories, and apps that aren't on GitHub

Upload a .zip of the code on the check page, under "Private repo, or not on GitHub?":

• From a private GitHub repository: Code → Download ZIP.
• From an AI app builder: most can download a project as a zip.
• Up to 4 MB. That's plenty for an app's own code, but not with node_modules in it, so zip the project without it (and without .next, dist, build and .git).

The zip is read in memory, checked and thrown away, like a repository. Its report has no share link or badge, since there's no public address to point them at, and it's never cached.

Or run the check in the console under Launch check: it reads any repository you've given Launchpad's GitHub App, private ones included, and the report is shown only to you, with no share link or badge.

What's needed on GitHub:

1. Install Launchpad's GitHub App with access to the repository. If you installed it to import repositories, open GitHub → Settings → Applications → Launchpad → Configure, and under Repository access either choose All repositories or add the private one under Only select repositories. An organization's repositories are granted the same way, by an organization owner.
2. Nothing else. The App only needs Contents: read, which it already has for importing, so there's no new permission to accept.

The App's token is short-lived, issued by GitHub for that installation, and used only to download the repository once for the check. Nothing from the repository is kept.

On your computer

The same check runs on the app's folder, with nothing uploaded:

• From the command line: npx @axonscape/launchpad launch-check in the app's folder. See Deploy from the command line.
• From an AI agent: with Launchpad's MCP server added, ask Claude Code, Cursor or another agent "is my app ready to launch?". It runs the check, then can fix what it finds.

It reads the files git would commit (or, outside a git repository, every file except node_modules, builds and caches), so private repositories and apps that were never on GitHub work too. Each finding links to its step-by-step page in the fixes.

What it doesn't do

• It reads public repositories, and zips you upload, on this site; private repositories directly only in the console, through the App.
• It keeps nothing: the code is read, checked and thrown away.
• It's a first pass, not a security audit. A clean score means the common mistakes aren't there.