Preflight

Static pre-launch checks for apps built with AI coding tools. Runs locally with no network calls or runtime dependencies. Requires Node.js 18 or newer.

npx preflight-scan ./my-project

The free scanner contains 31 rule definitions for common credential exposure, configuration and deployment issues. Some checks are heuristic or require manual review; findings are not proof of exploitability.

Usage

npx preflight-scan ./my-project --md report.md
npx preflight-scan ./my-project --json report.json
npx preflight-scan ./my-project --pro /path/to/preflight.pro.json
npx preflight-scan ./my-project --init

Detected credential patterns are redacted. Review reports for sensitive information before sharing. Generated reports include project paths.

Exit codes: 0 means no critical/high findings; 1 means critical/high findings; 2 means the scan could not run. --no-fail suppresses the findings exit code. Use --help for options.

The scanner skips dependencies, common build directories, binary files, symbolic links and files over 512 KB by default. Add glob patterns to .preflightignore for more exclusions. Use a preflight-ignore comment on a line to suppress a finding deliberately.

Optional Pro pack

The paid pack supplies 36 additional rule definitions, including manual checks, plus fix guides and templates. It is sold separately at https://whop.com/preflight-3803/ and is not included in this npm package.

Limits

Preflight is a static checker, not a security audit or penetration test. It can miss issues and produce false positives. A clean report does not guarantee security or App Store approval. It does not inspect deployed systems or verify live credentials.

License

The scanner is MIT licensed. Paid rules and guides have separate license terms.