Set and check consumption guardrails for an AI product: per-customer daily and monthly spend caps, month-end forecasts, spend spike rules, runaway agent runs, and failure rate spikes, plus a runbook for what to do when each alert fires. Runs on usage files; exit code 2 on critical alerts for cron or CI.
Check your repo for leaked secrets before you push or launch: .env files git tracks or will pick up, .env files hiding in git history, server keys behind NEXT_PUBLIC_ or VITE_ prefixes that ship to the browser, provider key shapes (Stripe, AWS, GitHub, OpenAI, Anthropic, Supabase service_role), and passwords hardcoded in code. Reports names and redacted hints, never the values.
A pre-launch check for your first real app. Reads your project, detects the stack (Supabase, Stripe, Next.js, auth, email), and writes a checklist split into blockers, first-week items, and later, with evidence from your code for each item it could verify. Covers data access, payments, secrets, auth, abuse limits, errors and monitoring, backups, email deliverability, legal pages, and SEO basics.
Find your Stripe webhook handlers and harden them: verify the Stripe-Signature header, use the raw body, keep the signing secret in env, process each event once, reject bad signatures with 400, and fulfill orders from the webhook rather than the success page. Reads your code and proposes diffs; never calls Stripe.
Audit row level security in your Supabase migrations before you launch. Finds tables with RLS off, policies that let anyone write, policies that trust user_metadata, views that skip RLS, and risky SECURITY DEFINER functions, then drafts a fix migration for you to review. Reads .sql files only and never touches your database.
Paste a failed Vercel or Netlify build log and get the most likely cause and a fix you can apply. Recognizes about twenty common failures: letter-case import errors, missing packages, missing env vars, prerender errors, window is not defined, lockfile drift, peer dependency conflicts, wrong Node version, out of memory, wrong output or root folder, oversized functions, and more.
A CLAUDE.md rule that keeps development and production behaving the same: prefer explicit environment flags over NODE_ENV checks, and write down every unavoidable difference in the deploy guide in the same change.
Before adding or upgrading a package: confirm the version exists, is the latest stable release, and is at least 14 days old, then pin it exactly and commit the lockfile. A simple guard against typosquats and freshly compromised releases.
Write a short smoke test script for a live site: the status endpoint, the home page, search, sign-in redirects, and any connected services, each retried while a new deploy settles. Exits non-zero on the first failure so a release can roll back.
Set up a release pipeline with no manual gates: when CI passes on main, migrate the database, deploy, run a smoke test, and roll back on its own if the smoke test fails. Writes the GitHub Actions workflow for you to review; never deploys or stores secrets itself.
Check a canvas or WebGL animation frame by frame when the browser cannot take screenshots (a hidden pane, a background tab, a headless run). Captures timed frames from the page itself and saves them as small images you can look at. Writes only to a frames folder you choose.
Rename a product across code, copy, CLI, plugins, and docs without breaking anything: one name constant, a careful sweep, and a list of strings that must keep the old name (signing labels, key-derivation labels, OAuth client ids, stored rule ids, migrations). Shows the plan and asks before it edits.
