1---2name: web-launch-gate3description: Web Launch Gate4---56# Web Launch Gate78> **Trigger**: Activates automatically when deploying any web-facing application.9> **Authority**: This gate is MANDATORY. Do not skip items marked 🔴.1011---1213## Pre-Flight Checklist1415Run every item before deploying. Items marked 🔴 are **blocking** — deployment MUST NOT proceed if they fail. Items marked 🟡 are **warnings** — flag to the user but don't block.1617---1819### 1. Secrets & Keys2021| # | Check | Severity | How to Verify |22|---|-------|----------|---------------|23| 1.1 | `.env` / `.env.*` is in `.gitignore` | 🔴 Critical | `grep -n "\.env" .gitignore` |24| 1.2 | No API keys, tokens, or passwords hardcoded in source | 🔴 Critical | `grep -rn "sk-\|sk_live\|AKIA\|ghp_\|glpat-\|xoxb-\|Bearer [A-Za-z0-9]" --include="*.{ts,js,py,tsx,jsx}" .` |25| 1.3 | No secrets in `console.log`, `print()`, or error responses | 🔴 Critical | `grep -rn "console\.log.*key\|console\.log.*secret\|console\.log.*token\|console\.log.*password" --include="*.{ts,js,tsx,jsx}" .` |26| 1.4 | All keys loaded from environment variables or secret manager | 🔴 Critical | Manual review of config/init files |27| 1.5 | Frontend code does NOT contain server-side keys | 🔴 Critical | Check `src/`, `public/`, `app/` for any `process.env.SECRET_*` usage that gets bundled client-side. In Next.js, only `NEXT_PUBLIC_*` vars reach the browser — everything else must stay server-side. |2829---3031### 2. Authentication & Authorization3233| # | Check | Severity | How to Verify |34|---|-------|----------|---------------|35| 2.1 | Auth is implemented if any user data is stored | 🔴 Critical | Review auth provider setup |36| 2.2 | Protected routes/API endpoints require authentication | 🔴 Critical | Test unauthenticated access to protected endpoints |37| 2.3 | JWT `verify_jwt` is `true` for edge functions / API routes | 🔴 Critical | Check `supabase/config.toml` or middleware config |38| 2.4 | RLS (Row Level Security) enabled on all database tables | 🔴 Critical | `SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public';` |39| 2.5 | Password minimum length ≥ 8 characters | 🟡 Warning | Check auth config |4041---4243### 3. Input Validation & Injection4445| # | Check | Severity | How to Verify |46|---|-------|----------|---------------|47| 3.1 | No raw SQL string concatenation (use parameterized queries / ORM) | 🔴 Critical | `grep -rn "execute.*f\"\|execute.*%s\|\.query.*\+\|\.query.*\`\$\{" --include="*.{ts,js,py}" .` |48| 3.2 | User input is sanitized before rendering in HTML (XSS prevention) | 🔴 Critical | Check for `dangerouslySetInnerHTML`, `innerHTML`, `v-html`, or unescaped template literals |49| 3.3 | File uploads validated (type, size, extension whitelist) | 🟡 Warning | Check upload handlers for MIME type and size checks |50| 3.4 | CORS configured to allow only known origins (not `*` in production) | 🔴 Critical | `grep -rn "Access-Control-Allow-Origin.*\*\|cors.*origin.*\*" .` |5152---5354### 4. Data Privacy5556| # | Check | Severity | How to Verify |57|---|-------|----------|---------------|58| 4.1 | Privacy policy exists if collecting ANY user data (name, email, analytics, cookies) | 🔴 Critical | Check for `/privacy` route or linked policy page |59| 4.2 | You know WHERE user data is stored (DB region, provider, backups) | 🔴 Critical | Document in README or deployment notes |60| 4.3 | API responses don't return more data than the client needs | 🟡 Warning | Review API response shapes — no full DB rows with internal IDs, emails of other users, etc. |61| 4.4 | User data deletion path exists (GDPR right to erasure) | 🟡 Warning | If serving EU users, there must be a way to delete user data on request |6263---6465### 5. Security Headers6667| # | Check | Severity | How to Verify |68|---|-------|----------|---------------|69| 5.1 | `X-Content-Type-Options: nosniff` | 🟡 Warning | Check response headers |70| 5.2 | `X-Frame-Options: DENY` or CSP `frame-ancestors` | 🟡 Warning | Prevents clickjacking |71| 5.3 | `Strict-Transport-Security` (HSTS) header set | 🟡 Warning | Forces HTTPS |72| 5.4 | `Content-Security-Policy` configured | 🟡 Warning | Prevents inline script injection |7374> **Shortcut**: Most hosting platforms (Vercel, Netlify, Firebase Hosting) handle some of these automatically. Still verify with `curl -I https://your-app.com`.7576---7778### 6. Abuse Prevention7980| # | Check | Severity | How to Verify |81|---|-------|----------|---------------|82| 6.1 | Rate limiting on API endpoints (especially auth, AI calls, webhooks) | 🔴 Critical | Check for rate-limit middleware or provider-level limits |83| 6.2 | Rate limiting on expensive operations (LLM calls, email sends, file processing) | 🔴 Critical | Someone WILL find your endpoint and loop it |84| 6.3 | CAPTCHA or bot protection on public forms | 🟡 Warning | hCaptcha, Turnstile, or reCAPTCHA on signup/contact forms |85| 6.4 | Cost caps / billing alerts set on cloud providers | 🟡 Warning | Vercel, Supabase, OpenAI, Google Cloud — set spending limits |8687---8889## Execution Protocol9091When this gate activates:92931. **Run each section's checks** against the codebase being deployed942. **Report results** as a pass/fail table to the user953. **If ANY 🔴 item fails**: State clearly that deployment should not proceed and list the specific fixes needed964. **If only 🟡 items flag**: Inform the user of the warnings but do not block deployment975. **Log the audit result** — note which items were checked and their status9899### Quick-Scan Commands (Copy-Paste Ready)100101```bash102# 1. Check .gitignore covers secrets103grep -n "\.env" .gitignore104105# 2. Scan for hardcoded keys (common patterns)106grep -rnI "sk-\|sk_live_\|AKIA\|ghp_\|glpat-\|xoxb-\|Bearer " --include="*.ts" --include="*.js" --include="*.py" --include="*.tsx" --include="*.jsx" .107108# 3. Scan for console.log with sensitive terms109grep -rnI "console\.log.*key\|console\.log.*secret\|console\.log.*token" --include="*.ts" --include="*.js" --include="*.tsx" --include="*.jsx" .110111# 4. Scan for dangerous HTML injection112grep -rnI "dangerouslySetInnerHTML\|innerHTML\|v-html" --include="*.ts" --include="*.js" --include="*.tsx" --include="*.jsx" .113114# 5. Check for wildcard CORS115grep -rnI "Access-Control-Allow-Origin.*\*\|cors.*origin.*true" --include="*.ts" --include="*.js" --include="*.py" .116117# 6. Check security headers118curl -sI https://YOUR-APP-URL | grep -iE "strict-transport|x-content-type|x-frame|content-security"119```120121---122123## When This Skill Does NOT Apply124125- Local-only tools (CLI scripts, desktop apps not exposed to network)126- Private repos with no deployed frontend/API127- Internal dashboards behind VPN with no public access128129---130131## Source132133Codified from:134- r/vibecoding pre-launch checklist (PaddleboardNut, 2026-05)135- OWASP Top 10 (2021 edition — injection, broken auth, security misconfig, XSS)136- Athena v9.8.0 security hardening sprint (keychain migration, RLS deployment, mutable search_path fix)137- Real-world deployment failures observed across client projects
winstonkoh87