@preflight-agent/cli 0.1.0

package/dist/checks/vulnerabilities.js

@@ -0,0 +1,161 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runVulnerabilityChecks = runVulnerabilityChecks;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const glob_1 = require("glob");
+async function runVulnerabilityChecks(dir) {
+    const results = [];
+    const allTsFiles = await (0, glob_1.glob)(`${dir}/src/**/*.{ts,tsx,js,jsx}`, { ignore: ['**/node_modules/**', '**/.next/**'] });
+    const allFiles = await (0, glob_1.glob)(`${dir}/**/*.{ts,tsx,js,jsx,json,env,yml,yaml,config.*}`, { ignore: ['**/node_modules/**', '**/.next/**', '**/dist/**'] });
+    // --- 1. XSS: dangerouslySetInnerHTML / innerHTML ---
+    let hasUnsafeHTML = false;
+    let unsafeHTMLFile;
+    for (const file of allTsFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        if (content.includes('dangerouslySetInnerHTML') || content.includes('.innerHTML =')) {
+            hasUnsafeHTML = true;
+            unsafeHTMLFile = path_1.default.relative(dir, file);
+            break;
+        }
+    }
+    results.push(hasUnsafeHTML
+        ? { status: 'warn', message: 'dangerouslySetInnerHTML or innerHTML assignment found \u2014 potential XSS risk', file: unsafeHTMLFile }
+        : { status: 'pass', message: 'No dangerouslySetInnerHTML or innerHTML assignments found' });
+    // --- 2. eval() usage ---
+    let hasEval = false;
+    let evalFile;
+    for (const file of allTsFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const trimmed = lines[i].trim();
+            if (/eval\s*\(/.test(trimmed) && !trimmed.startsWith('//') && !trimmed.startsWith('*')) {
+                hasEval = true;
+                evalFile = path_1.default.relative(dir, file);
+                break;
+            }
+        }
+        if (hasEval)
+            break;
+    }
+    results.push(hasEval
+        ? { status: 'fail', message: 'eval() usage detected \u2014 arbitrary code execution risk', file: evalFile }
+        : { status: 'pass', message: 'No eval() usage detected' });
+    // --- 3. Sniffing protection: X-Content-Type-Options ---
+    const configFiles = [
+        'next.config.ts', 'next.config.js', 'next.config.mjs',
+        '.htaccess', 'nginx.conf', 'web.config',
+    ];
+    let hasNosniff = false;
+    let nosniffFile;
+    for (const cfg of configFiles) {
+        const cfgPath = path_1.default.join(dir, cfg);
+        if (fs_1.default.existsSync(cfgPath)) {
+            const content = fs_1.default.readFileSync(cfgPath, 'utf-8');
+            if (content.includes('nosniff') || content.includes('X-Content-Type-Options')) {
+                hasNosniff = true;
+                nosniffFile = cfg;
+                break;
+            }
+        }
+    }
+    results.push(hasNosniff
+        ? { status: 'pass', message: 'X-Content-Type-Options: nosniff found \u2014 MIME sniffing protection enabled', file: nosniffFile }
+        : { status: 'warn', message: 'No X-Content-Type-Options: nosniff found \u2014 browser may MIME-sniff responses' });
+    // --- 4. HSTS ---
+    let hasHSTS = false;
+    let hstsFile;
+    for (const cfg of configFiles) {
+        const cfgPath = path_1.default.join(dir, cfg);
+        if (fs_1.default.existsSync(cfgPath)) {
+            const content = fs_1.default.readFileSync(cfgPath, 'utf-8');
+            if (content.includes('Strict-Transport-Security') || content.includes('HSTS') || content.includes('hsts')) {
+                hasHSTS = true;
+                hstsFile = cfg;
+                break;
+            }
+        }
+    }
+    results.push(hasHSTS
+        ? { status: 'pass', message: 'HSTS (Strict-Transport-Security) configured', file: hstsFile }
+        : { status: 'warn', message: 'No HSTS header found \u2014 users may connect over HTTP instead of HTTPS' });
+    // --- 5. Mixed content: http:// URLs in source ---
+    let hasMixedContent = false;
+    const mixedContentFiles = [];
+    for (const file of allTsFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        const httpMatches = content.match(/https?:\/\/(?!localhost)(?!127\.0\.0\.1)(?![\w.-]*\.\w{2,}\/)[^\s"'`)*]+/g);
+        if (httpMatches) {
+            const insecureUrls = httpMatches.filter(u => u.startsWith('http://'));
+            if (insecureUrls.length > 0) {
+                hasMixedContent = true;
+                mixedContentFiles.push(path_1.default.relative(dir, file));
+            }
+        }
+    }
+    results.push(hasMixedContent
+        ? { status: 'warn', message: `http:// URLs found in ${mixedContentFiles.length} file(s) \u2014 mixed content vulnerability`, file: mixedContentFiles[0] }
+        : { status: 'pass', message: 'No mixed content (http:// URLs) detected in source' });
+    // --- 6. CSRF protection ---
+    const csrfPatterns = [
+        'csrf', 'CSRF', 'csrfToken', 'xsrf', 'XSRF',
+        'SameSite', 'sameSite', 'same-site',
+        'doubleSubmit', 'csrfProtection',
+    ];
+    let hasCSRF = false;
+    let csrfFile;
+    for (const file of allTsFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        for (const pattern of csrfPatterns) {
+            if (content.includes(pattern)) {
+                hasCSRF = true;
+                csrfFile = path_1.default.relative(dir, file);
+                break;
+            }
+        }
+        if (hasCSRF)
+            break;
+    }
+    results.push(hasCSRF
+        ? { status: 'pass', message: 'CSRF protection detected (token or SameSite cookie)', file: csrfFile }
+        : { status: 'warn', message: 'No CSRF protection detected \u2014 forms and API mutations may be vulnerable to cross-site requests' });
+    // --- 7. Debug mode / information disclosure ---
+    let hasDebugLeak = false;
+    let debugFile;
+    for (const file of allTsFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            if ((line.includes('debug: true') || line.includes('debug = true') || line.includes('isDebug = true')) &&
+                !line.trim().startsWith('//')) {
+                hasDebugLeak = true;
+                debugFile = path_1.default.relative(dir, file);
+                break;
+            }
+        }
+        if (hasDebugLeak)
+            break;
+    }
+    results.push(hasDebugLeak
+        ? { status: 'warn', message: 'Debug mode enabled in source \u2014 may expose sensitive info in production', file: debugFile }
+        : { status: 'pass', message: 'No debug mode flags detected in source' });
+    // --- 8. Check .gitignore for common build artifacts ---
+    const gitignorePath = path_1.default.join(dir, '.gitignore');
+    if (fs_1.default.existsSync(gitignorePath)) {
+        const gitignore = fs_1.default.readFileSync(gitignorePath, 'utf-8');
+        const expectedEntries = ['.next', 'dist', 'build', '.env.local', 'coverage', '.turbo'];
+        const missing = expectedEntries.filter(e => !gitignore.includes(e));
+        if (missing.length === 0) {
+            results.push({ status: 'pass', message: 'All common build artifacts are gitignored (.next, dist, build, .env.local)' });
+        }
+        else {
+            results.push({ status: 'warn', message: `Build artifacts not gitignored: ${missing.join(', ')} \u2014 they may leak in the repo` });
+        }
+    }
+    return results;
+}

package/dist/checks/web.js

@@ -0,0 +1,61 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runWebChecks = runWebChecks;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const glob_1 = require("glob");
+async function runWebChecks(dir) {
+    const results = [];
+    const nextConfigPaths = [
+        path_1.default.join(dir, 'next.config.ts'),
+        path_1.default.join(dir, 'next.config.js'),
+        path_1.default.join(dir, 'next.config.mjs'),
+    ];
+    const existingConfigs = nextConfigPaths.filter(fs_1.default.existsSync);
+    if (existingConfigs.length > 0) {
+        const content = fs_1.default.readFileSync(existingConfigs[0], 'utf-8');
+        const hasCSP = content.includes('Content-Security-Policy') || content.includes('csp');
+        const hasFrameOptions = content.includes('X-Frame-Options') || content.includes('frame-ancestors');
+        const hasCORS = content.includes('cors') || content.includes('CORS') || content.includes('Access-Control');
+        if (hasCSP) {
+            results.push({ status: 'pass', message: 'Content Security Policy (CSP) configured', file: path_1.default.relative(dir, existingConfigs[0]) });
+        }
+        else {
+            results.push({ status: 'warn', message: 'No Content Security Policy (CSP) found \u2014 your app is vulnerable to XSS' });
+        }
+        if (hasFrameOptions) {
+            results.push({ status: 'pass', message: 'Clickjacking protection found (X-Frame-Options / frame-ancestors)' });
+        }
+        else {
+            results.push({ status: 'warn', message: 'No clickjacking protection \u2014 your app can be embedded in iframes' });
+        }
+        if (hasCORS) {
+            results.push({ status: 'pass', message: 'CORS configuration detected' });
+        }
+        else {
+            results.push({ status: 'warn', message: 'No explicit CORS configuration found' });
+        }
+    }
+    else {
+        results.push({ status: 'warn', message: 'No Next.js config found \u2014 skipping security header checks' });
+    }
+    const cookieFiles = await (0, glob_1.glob)(`${dir}/**/*.ts`, { ignore: ['**/node_modules/**', '**/.next/**'] });
+    let hasSecureCookies = false;
+    let cookieFile;
+    for (const file of cookieFiles) {
+        const content = fs_1.default.readFileSync(file, 'utf-8');
+        const hasCookie = content.includes('cookie') || content.includes('Cookie') || content.includes('cookies');
+        if (hasCookie && (content.includes('httpOnly') || content.includes('secure') || content.includes('sameSite'))) {
+            hasSecureCookies = true;
+            cookieFile = path_1.default.relative(dir, file);
+            break;
+        }
+    }
+    results.push(hasSecureCookies
+        ? { status: 'pass', message: 'Cookie security flags (httpOnly/secure/sameSite) detected', file: cookieFile }
+        : { status: 'warn', message: 'No secure cookie flags detected \u2014 cookies may be accessible to JavaScript' });
+    return results;
+}

package/dist/index.js

@@ -0,0 +1,20 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const scan_1 = require("./scan");
+const program = new commander_1.Command();
+program
+    .name('preflight')
+    .description('Pre-deploy checklist CLI for vibe coders')
+    .version('0.1.0');
+program
+    .command('scan [dir]')
+    .description('Scan a project for common pre-deploy issues')
+    .option('--json', 'Output results as JSON')
+    .option('--strict', 'Exit with code 1 if any checks fail')
+    .option('--only <category>', 'Run only one category: security|auth|payments|database|api|web|graphql|realtime|vulnerabilities')
+    .action(async (dir = '.', options) => {
+    await (0, scan_1.runScan)(dir, options);
+});
+program.parse();

package/dist/reporter.js

@@ -0,0 +1,45 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderReport = renderReport;
+const chalk_1 = __importDefault(require("chalk"));
+function icon(status) {
+    if (status === 'pass')
+        return chalk_1.default.green('\u2705');
+    if (status === 'fail')
+        return chalk_1.default.red('\u274C');
+    return chalk_1.default.yellow('\u26A0\uFE0F');
+}
+function score(categories) {
+    const all = categories.flatMap((c) => c.checks);
+    const passed = all.filter((c) => c.status === 'pass').length;
+    return { passed, total: all.length };
+}
+function renderReport(dir, categories) {
+    console.log('');
+    console.log(chalk_1.default.bold('\u{1F6EB} Agent Preflight \u2014 Pre-Deploy Scan'));
+    console.log(chalk_1.default.dim(`Scanning: ${dir}`));
+    console.log('');
+    for (const category of categories) {
+        console.log(chalk_1.default.bold(`  ${category.name}`));
+        for (const check of category.checks) {
+            const location = check.file
+                ? chalk_1.default.dim(` (${check.file}${check.line ? `:${check.line}` : ''})`)
+                : '';
+            console.log(`  ${icon(check.status)}  ${check.message}${location}`);
+        }
+        console.log('');
+    }
+    const { passed, total } = score(categories);
+    const ratio = `${passed}/${total}`;
+    const fails = categories.flatMap((c) => c.checks).filter((c) => c.status === 'fail');
+    if (fails.length === 0) {
+        console.log(chalk_1.default.green(`Score: ${ratio} \u2014 All clear. Ready to deploy. \u{1F680}`));
+    }
+    else {
+        console.log(chalk_1.default.red(`Score: ${ratio} \u2014 Fix ${fails.length} critical issue${fails.length > 1 ? 's' : ''} before deploying.`));
+    }
+    console.log('');
+}

package/dist/scan.js

@@ -0,0 +1,107 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runScan = runScan;
+const path_1 = __importDefault(require("path"));
+const ora_1 = __importDefault(require("ora"));
+const security_1 = require("./checks/security");
+const auth_1 = require("./checks/auth");
+const payments_1 = require("./checks/payments");
+const database_1 = require("./checks/database");
+const api_1 = require("./checks/api");
+const web_1 = require("./checks/web");
+const graphql_1 = require("./checks/graphql");
+const realtime_1 = require("./checks/realtime");
+const vulnerabilities_1 = require("./checks/vulnerabilities");
+const reporter_1 = require("./reporter");
+async function runScan(dir, options) {
+    const absoluteDir = path_1.default.resolve(process.cwd(), dir);
+    const spinner = (0, ora_1.default)(`Scanning: ${absoluteDir}`).start();
+    try {
+        const categories = [];
+        const shouldRun = (name) => !options.only || options.only.toLowerCase() === name;
+        if (shouldRun('security')) {
+            spinner.text = 'Checking security...';
+            categories.push({
+                name: 'Security',
+                checks: await (0, security_1.runSecurityChecks)(absoluteDir),
+            });
+        }
+        if (shouldRun('auth')) {
+            spinner.text = 'Checking authentication...';
+            categories.push({
+                name: 'Authentication',
+                checks: await (0, auth_1.runAuthChecks)(absoluteDir),
+            });
+        }
+        if (shouldRun('payments')) {
+            spinner.text = 'Checking payments...';
+            categories.push({
+                name: 'Payments',
+                checks: await (0, payments_1.runPaymentChecks)(absoluteDir),
+            });
+        }
+        if (shouldRun('database')) {
+            spinner.text = 'Checking database...';
+            categories.push({
+                name: 'Database',
+                checks: await (0, database_1.runDatabaseChecks)(absoluteDir),
+            });
+        }
+        if (shouldRun('api')) {
+            spinner.text = 'Checking API & Validation...';
+            categories.push({
+                name: 'API & Validation',
+                checks: await (0, api_1.runApiChecks)(absoluteDir),
+            });
+        }
+        if (shouldRun('web')) {
+            spinner.text = 'Checking web security...';
+            categories.push({
+                name: 'Web Security',
+                checks: await (0, web_1.runWebChecks)(absoluteDir),
+            });
+        }
+        if (shouldRun('graphql')) {
+            spinner.text = 'Checking GraphQL...';
+            categories.push({
+                name: 'GraphQL',
+                checks: await (0, graphql_1.runGraphqlChecks)(absoluteDir),
+            });
+        }
+        if (shouldRun('realtime')) {
+            spinner.text = 'Checking real-time connections...';
+            categories.push({
+                name: 'Real-Time',
+                checks: await (0, realtime_1.runRealtimeChecks)(absoluteDir),
+            });
+        }
+        if (shouldRun('vulnerabilities')) {
+            spinner.text = 'Checking for web vulnerabilities...';
+            categories.push({
+                name: 'Vulnerabilities',
+                checks: await (0, vulnerabilities_1.runVulnerabilityChecks)(absoluteDir),
+            });
+        }
+        spinner.stop();
+        if (options.json) {
+            console.log(JSON.stringify(categories, null, 2));
+        }
+        else {
+            (0, reporter_1.renderReport)(absoluteDir, categories);
+        }
+        const hasFail = categories
+            .flatMap((c) => c.checks)
+            .some((c) => c.status === 'fail');
+        if (options.strict && hasFail) {
+            process.exit(1);
+        }
+    }
+    catch (err) {
+        spinner.fail('Scan failed');
+        console.error(err);
+        process.exit(1);
+    }
+}

package/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "@preflight-agent/cli",
+  "version": "0.1.0",
+  "description": "Pre-deploy checklist CLI for vibe coders",
+  "main": "dist/index.js",
+  "bin": {
+    "preflight": "dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "ts-node src/index.ts",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "dotenv": "^16.4.0",
+    "glob": "^10.3.0",
+    "ora": "^8.0.1"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "typescript": "^5.4.0",
+    "ts-node": "^10.9.0"
+  },
+  "license": "MIT"
+}

package/src/checks/api.ts

@@ -0,0 +1,74 @@
+import fs from 'fs';
+import path from 'path';
+import { glob } from 'glob';
+import type { CheckResult } from '../scan';
+
+export async function runApiChecks(dir: string): Promise<CheckResult[]> {
+  const results: CheckResult[] = [];
+
+  const apiFiles: string[] = await glob(`${dir}/src/app/api/**/*.ts`, {
+    ignore: ['**/node_modules/**']
+  });
+
+  if (apiFiles.length === 0) {
+    const altFiles = await glob(`${dir}/pages/api/**/*.ts`, { ignore: ['**/node_modules/**'] });
+    if (altFiles.length === 0) {
+      results.push({ status: 'warn', message: 'No API routes found \u2014 skipping API checks' });
+      return results;
+    }
+    apiFiles.push(...altFiles);
+  }
+
+  let validatedRoutes = 0;
+  const unvalidatedRoutes: string[] = [];
+
+  for (const file of apiFiles) {
+    const content = fs.readFileSync(file, 'utf-8');
+    const hasPOST = content.includes('POST') || content.includes('req.body') || content.includes('request.json()');
+    const hasValidation =
+      content.includes('z.object') ||
+      content.includes('yup.object') ||
+      content.includes('v.object') ||
+      content.includes('.parse(') ||
+      content.includes('.safeParse(') ||
+      content.includes('.validate(');
+
+    if (hasPOST && hasValidation) {
+      validatedRoutes++;
+    } else if (hasPOST && !hasValidation) {
+      unvalidatedRoutes.push(path.relative(dir, file));
+    }
+  }
+
+  if (unvalidatedRoutes.length === 0) {
+    results.push({ status: 'pass', message: 'Input validation (Zod/Yup) found on POST routes' });
+  } else {
+    results.push({
+      status: 'warn',
+      message: `${unvalidatedRoutes.length} POST route${unvalidatedRoutes.length > 1 ? 's' : ''} missing input validation`,
+    });
+    for (const route of unvalidatedRoutes.slice(0, 2)) {
+      results.push({ status: 'warn', message: 'No input validation detected', file: route });
+    }
+  }
+
+  const allFiles = await glob(`${dir}/src/**/*.ts`, { ignore: ['**/node_modules/**'] });
+  const hasRateLimit = allFiles.some(file => {
+    const content = fs.readFileSync(file, 'utf-8');
+    return (
+      content.includes('ratelimit') ||
+      content.includes('rate-limit') ||
+      content.includes('upstash') ||
+      content.includes('redis') ||
+      content.includes('limiter')
+    );
+  });
+
+  results.push(
+    hasRateLimit
+      ? { status: 'pass', message: 'Rate limiting detected' }
+      : { status: 'warn', message: 'No rate limiting found \u2014 your API is open to abuse' }
+  );
+
+  return results;
+}

package/src/checks/auth.ts

@@ -0,0 +1,76 @@
+import fs from 'fs';
+import path from 'path';
+import { glob } from 'glob';
+import type { CheckResult } from '../scan';
+
+export async function runAuthChecks(dir: string): Promise<CheckResult[]> {
+  const results: CheckResult[] = [];
+
+  const middlewarePaths = [
+    path.join(dir, 'middleware.ts'),
+    path.join(dir, 'src/middleware.ts'),
+    path.join(dir, 'middleware.js'),
+  ];
+
+  const hasMiddleware = middlewarePaths.some(fs.existsSync);
+  if (hasMiddleware) {
+    results.push({ status: 'pass', message: 'Auth middleware file found' });
+  } else {
+    results.push({ status: 'warn', message: 'No middleware.ts found \u2014 protected routes may be unsecured' });
+  }
+
+  const envExamplePath = path.join(dir, '.env.example');
+  if (fs.existsSync(envExamplePath)) {
+    const envExample = fs.readFileSync(envExamplePath, 'utf-8');
+    const hasAuthSecret =
+      envExample.includes('JWT_SECRET') ||
+      envExample.includes('NEXTAUTH_SECRET') ||
+      envExample.includes('AUTH_SECRET');
+    if (hasAuthSecret) {
+      results.push({ status: 'pass', message: 'Auth secret documented in .env.example' });
+    } else {
+      results.push({ status: 'warn', message: 'No JWT_SECRET or NEXTAUTH_SECRET in .env.example' });
+    }
+  }
+
+  const apiFiles = await glob(`${dir}/src/app/api/**/*.ts`, { ignore: ['**/node_modules/**'] });
+  const suspiciousRoutes: string[] = [];
+
+  for (const file of apiFiles) {
+    const content = fs.readFileSync(file, 'utf-8');
+    const hasAuthCheck =
+      content.includes('getServerSession') ||
+      content.includes('auth()') ||
+      content.includes('verifyToken') ||
+      content.includes('supabase.auth') ||
+      content.includes('requireAuth') ||
+      content.includes('middleware');
+
+    const looksPrivate =
+      content.includes('userId') ||
+      content.includes('user_id') ||
+      content.includes('DELETE') ||
+      content.includes('UPDATE') ||
+      file.includes('/admin/') ||
+      file.includes('/user/') ||
+      file.includes('/profile/');
+
+    if (looksPrivate && !hasAuthCheck) {
+      suspiciousRoutes.push(path.relative(dir, file));
+    }
+  }
+
+  if (suspiciousRoutes.length > 0) {
+    for (const route of suspiciousRoutes.slice(0, 3)) {
+      results.push({
+        status: 'warn',
+        message: 'No auth check detected in route that may require it',
+        file: route,
+      });
+    }
+  } else if (apiFiles.length > 0) {
+    results.push({ status: 'pass', message: 'Auth checks found in API routes' });
+  }
+
+  return results;
+}

package/src/checks/database.ts

@@ -0,0 +1,48 @@
+import fs from 'fs';
+import path from 'path';
+import { glob } from 'glob';
+import type { CheckResult } from '../scan';
+
+export async function runDatabaseChecks(dir: string): Promise<CheckResult[]> {
+  const results: CheckResult[] = [];
+
+  const migrationFiles = await glob(`${dir}/**/*.sql`, {
+    ignore: ['**/node_modules/**']
+  });
+
+  const supabaseDirs = [
+    path.join(dir, 'supabase'),
+    path.join(dir, 'src/supabase'),
+  ];
+  const hasSupabaseDir = supabaseDirs.some(fs.existsSync);
+
+  if (hasSupabaseDir || migrationFiles.length > 0) {
+    let hasRLS = false;
+    for (const file of migrationFiles) {
+      const content = fs.readFileSync(file, 'utf-8');
+      if (content.toLowerCase().includes('row level security') || content.toLowerCase().includes('enable rls')) {
+        hasRLS = true;
+        break;
+      }
+    }
+    results.push(
+      hasRLS
+        ? { status: 'pass', message: 'Row Level Security (RLS) enabled in migrations' }
+        : { status: 'fail', message: 'No RLS policies found in SQL migrations \u2014 your database may be fully open' }
+    );
+  } else {
+    results.push({ status: 'warn', message: 'No SQL migrations found \u2014 skipping RLS check' });
+  }
+
+  const envExamplePath = path.join(dir, '.env.example');
+  if (fs.existsSync(envExamplePath)) {
+    const env = fs.readFileSync(envExamplePath, 'utf-8');
+    if (env.includes('DATABASE_URL') || env.includes('SUPABASE_URL') || env.includes('NEXT_PUBLIC_SUPABASE_URL')) {
+      results.push({ status: 'pass', message: 'Database URL documented in .env.example' });
+    } else {
+      results.push({ status: 'warn', message: 'No database URL found in .env.example' });
+    }
+  }
+
+  return results;
+}