clawd-dockerfile-auditor-saas

Dockerfile security + best-practices auditor (B2B Micro‑SaaS).

• Upload a repo ZIP or paste a Dockerfile
• Runs 20+ rules (root user, :latest, missing HEALTHCHECK, ADD usage, secrets in ARG/ENV, wildcard EXPOSE, .dockerignore, curl | bash, etc.)
• Outputs a dashboard table with issues by severity and an A–F grade
• Pro: export a PDF audit report (via Puppeteer) + history (MVP stub)

Who buys this?

DevOps, platform engineering, and security teams who need a fast compliance signal on Dockerfiles without building images.

Why pay:

• Quick policy signal for PR reviews and vendor due‑diligence
• Catch risky patterns early (root, baked secrets, remote scripts)
• Exportable PDF evidence for audits and sharing

Local run

cd apps/clawd-dockerfile-auditor-saas
npm i
node index.js
# http://localhost:3000

Usage

• Home: http://localhost:3000/
• Results page: redirects to /results?id=...
• Pricing page: /pricing

API

• POST /api/scan
  • JSON: { "dockerfileText": "..." }
  • or multipart form-data: [email protected]
• GET /api/scan/:id
• GET /api/scan/:id/pdf?pro=1 (Pro feature; MVP gate)

Stripe (pricing stub)

The pricing page calls POST /create-checkout-session.

Set env vars:

• STRIPE_SECRET_KEY
• STRIPE_STARTER_PRICE_ID
• STRIPE_PRO_PRICE_ID

Example .env:

STRIPE_SECRET_KEY=sk_live_xxx
STRIPE_STARTER_PRICE_ID=price_xxx
STRIPE_PRO_PRICE_ID=price_xxx

Deploy (Vercel)

vercel
vercel --prod

Set the same env vars in Vercel Project Settings.

Notes

• This MVP stores scan results in memory (server restart clears history).
• For a sellable v1, wire Stripe webhooks + persistent storage for scan history.