Security audit for your web app before launch

Name: Security audit for your web app before launch
Author: @slashclone

@slashclone/security-review-checklist

Get a written security audit of your web app before launch or after a big feature. Covers the API, sign-in and OAuth, MCP connectors or CLIs, and file uploads, and writes a threat model plus numbered findings with severity, fix, and how each fix was verified. Reads the code and runs signed-out checks only; never changes your code.

SkillDevOpsv0.1.0

Use in Claude Save Like Clone Comment

Activity: New: be the first to try it
Installs: 0 installs
Likes: 0 likes
Clones: 0 clones

No comments yet.

Tried it? Say how it went, or ask the author anything.

Use in Claude

Ask Claude, with the connector

Install @slashclone/security-review-checklist from SlashClone

Claude Code, with the plugin

/kit add @slashclone/security-review-checklist

CLI

slashclone add @slashclone/security-review-checklist

Codex

slashclone add @slashclone/security-review-checklist --agent codex

Not enforced. Codex does not enforce the permissions this kit declares.

Cursor

slashclone add @slashclone/security-review-checklist --agent cursor

Not enforced. Cursor does not enforce the permissions this kit declares.

claude.ai and the desktop app

Download for Claude

Not enforced. claude.ai and the Claude desktop app do not enforce the permissions this kit declares. How to upload it

As a file

Download .kit

One file with everything in it. slashclone add ./file.kit checks it against this page before installing.

Review before installing

Set up SlashClone in Claude

Health

No keep-alive checks yet

Checks run weekly once someone keeps the kit installed.

Run reports are off

Safety

Scan passed
Not reviewed yet
No tests

This kit reads ** and writes to docs/security-review/**. Install it?

Full scan and review

Similar kits

Pre-launch checklist for your first app
@shipcheck
Find out what your app still needs before real users arrive, built from your actual code. Detects your stack (Supabase, Firebase, Stripe, Next.js, auth, email) and writes a checklist of blockers, first-week items, and later, each marked verified, failing, or a question for you. Covers data access, payments, secrets, auth, rate limits, monitoring, backups, email, legal pages, and SEO.
Check your app for leaked API keys and secrets
@shipcheck
Check whether you leaked API keys or secrets before you push, open-source, or launch your app. Finds .env files git tracks or kept in history, server keys exposed to the browser through NEXT_PUBLIC_ or VITE_, Stripe, AWS, OpenAI, Anthropic, and Supabase key shapes, and hardcoded passwords, then walks you through fixing and rotating them. Reports names and redacted hints, never the values.
Secure your Stripe webhook against fake payments
@shipcheck
Make sure nobody can fake a payment or get double credit through your Stripe webhook. Finds your handlers and checks signature verification, raw body, signing secret in env, once-only processing, 400 on bad signatures, and that access comes from the webhook, not the success page, then proposes diffs. Reads your code only; never calls Stripe.
Stop users seeing each other's data in Supabase
@shipcheck
Check that strangers and other users cannot read or change your data in Supabase before you launch. Replays your migrations to find tables with row level security off, policies that let anyone write or trust user_metadata, views that skip RLS, and risky SECURITY DEFINER functions, then drafts a fix migration for you to review. Reads .sql files only; never touches your database.

Link

https://slashclone.dev/@slashclone/security-review-checklist

README badge

[![Install with SlashClone](https://slashclone.dev/badge/slashclone/security-review-checklist.svg)](https://slashclone.dev/@slashclone/security-review-checklist?ref=slashclone)

Embed

<iframe src="https://slashclone.dev/embed/slashclone/security-review-checklist" width="480" height="200" title="@slashclone/security-review-checklist" loading="lazy"></iframe>

Share card image

More from @slashclone

A session log that parallel agents never conflict on
Keep a project log that several Claude Code sessions can write at once without merge conflicts. Each session writes its own dated file, an index is generated instead of hand edited, and a small CI check makes sure every entry carries the line your team requires. Writes the files for you to review; never commits or pushes.
Parallel sessions
Build faster with several Claude Code sessions at once. Splits a big plan into independent workstreams, writes a brief for each, runs each in its own git worktree and branch, and merges every pull request on green CI in a safe order. Works in the Claude Code desktop app and in the terminal.
Embed YouTube videos without tracking cookies
Embed YouTube videos on your site without loading anything from Google until the visitor presses Play or allows videos. A click-to-play placeholder with a local poster swaps in the youtube-nocookie.com player, with a keyboard-friendly button, no layout shift, CSP entries, and a Playwright test that proves no YouTube request happens first. React and HTML templates. Not legal advice.
Decide what to measure and build a metrics dashboard
Figure out what to measure in your web app and build a staff-only metrics dashboard for activation, retention, and funnels. You pick a few numbers per stage, write how each is counted, and compute most from tables you already have, so user data stays on your servers. Adds an audit log with no user content and loads any browser analytics only after consent.

See all of @slashclone's kits

Report this kit