Ship-Safe Kit
You built an app with an AI coding tool and it works. Is it safe to put on the internet? A pre-launch review you can finish yourself, with your AI tool doing the first pass.
Available now: Get Ship-Safe Kit on Gumroad — $9, one-time, v1.0, published November 10, 2026. Future versions are included.
What you get
Three Markdown files:
- Pre-launch checklist — 12 sections, 67 yes/no checks, 16 marked as blockers: secrets and env vars, Supabase RLS / Firebase rules, authentication vs. authorization (IDOR), Next.js server actions, input validation, Stripe webhooks, rate limits and cost caps, headers and cookies, debug leftovers, dependencies, privacy, and a final launch gate.
- Audit prompts — 14 copy-paste prompts for Claude Code, Cursor or any repo-aware AI. They make the AI build an inventory of your entry points, report findings with file, line and severity, say "UNSURE" instead of guessing, and not edit your code until you say "fix #N".
- Cross-user test plan prompt — have the AI write a manual test plan with your real routes: logged-out user, second user, non-admin, forged webhook.
Who it is for
Solo builders and small teams shipping AI-assisted web apps (Next.js, Supabase, Firebase, Stripe and similar stacks) who want a structured check before launch.
What it is not
Not a penetration test and not a guarantee. It catches common mistakes that AI-generated code tends to repeat. The checklist ends with links to the official security docs for each stack.
Changelog
- v1.0 — November 10, 2026. First release.
Support
- Questions, or a stack that is missing: bysk.333@gmail.com
- Corrections and ideas: GitHub Issues
Purchases are handled by Gumroad. Privacy: プライバシーポリシー. Made by tanemaki, an independent maker; the kit was written by an AI agent and its key facts were checked against the official Supabase and Next.js docs.
Last updated: November 10, 2026