launchprep.
launch readiness checker

It reads your code and tells you what will break.

288 checks — but it works out what you built before running any of them. You are not Instagram. You will not hear about Instagram's problems.

Runs on your machine. Reads your files, changes none of them, uploads nothing.

One command. Four things happen. No signup. No dashboard. Nothing living in your repo.

01
It reads

Every file, on your machine.

$ npx launchprep
1,847 files · 0.4s
02
It works out what you built

Stack, accounts, shared database, payments, where users live. Shown, so you can correct it.

express · postgres · vercel
tenancy shared · ai anthropic
03
It runs only what fits

The rest are skipped and listed with the reason.

94 apply · 155 skipped
39 need 3 answers
04
You fix it and run it again

Each finding carries a file, a line and the fix.

api/invoices/route.ts:14
CRITICAL no ownership check

Every check traces back to a published standard. Not one of them is a judgment call.

THE PROBLEM
40%

of AI-generated applications leak sensitive data. Mobb, 2026

  • 1.5M API authentication tokens, 35,000 email addresses and private messages exposed by one misconfigured database Moltbook, documented by Wiz
  • 170+ production AI-built applications shipped with row level security missing CVE-2025-48757
THE SOURCES
Published, not invented
  • OWASP ASVS and the OWASP Top 10 for LLM Applications — international, not regional
  • Security documentation from the platforms you already run on
  • Privacy and consumer law for the countries your users are actually in — GDPR, UK GDPR, CCPA, FTC Act

It asks where your users are, then applies only the law that reaches them. Every finding names its rule.

THE PROOF
Tested before it ships
  • Run against 68 production codebases in six languages
  • A check must fire on broken code and stay silent on correct code
  • 166 false alarms removed in tuning. A scanner that cries wolf is worse than none

Why not just ask Claude? You can, and you should. This is the part that is hard to ask for.

01

Asking is easy. Knowing what to ask is not.

“Review my code for security” gets you the top ten. It does not get you does deleting an organisation orphan its customers’ documents — a real finding, in a real repository, where the code’s own comment admitted it.

02

A list of findings with no denominator is a feeling.

Ask yourself and you get answers with no idea what was never looked at. This tells you the 155 it skipped, and why — and that list is the part you can check.

03

It tells you when it cannot tell.

39 checks it could not settle without asking you. A confident wrong answer costs more than an honest gap, and an open chat window rarely gives you the second one.

$29 buys 5 scans →
$12.95 inference · $1.14 Stripe · $14.91 us

One price, paid once. You launch once — not monthly. No subscription, no seats, no sales call.

FREE FOREVER $0
The 115 checks that don't need a brain.
  • Unlimited scans, no account
  • Every finding in full — file, line, fix
  • The skipped list, with reasons
$ npx launchprep
EVERYTHING $29 once
The 173 that need reading comprehension.
  • Authorization, tenant isolation, deletion, payment correctness — reviewed cold, by something with no stake in the code being fine
  • 5 deep scans, and a dated report at a link you can send a client
  • A CI gate that fails the build instead of warning
  • A year of new rules as frameworks change
Coming soon the free tier is finished and unlimited today —
run npx launchprep and pay nothing