shippingszn 0.8.5 → 0.9.0

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import * as path12 from "node:path";
+import * as path19 from "node:path";
 import * as process2 from "node:process";
 import { createRequire } from "node:module";
 
@@ -256,7 +256,8 @@ var PATTERN_DEFINITION_FILES = /* @__PURE__ */ new Set([
 ]);
 var PATTERN_DEFINITION_PREFIXES = [
   "tools/cli/test/fixtures/",
-  "artifacts/checklist/src/data/checklist/"
+  "artifacts/checklist/src/data/checklist/",
+  "lib/checklist-data/src/"
 ];
 function isScanExempt(relPath) {
   const p = relPosix(relPath);
@@ -266,6 +267,23 @@ function isScanExempt(relPath) {
   }
   return false;
 }
+function isLikelyNonRuntimePath(relPath) {
+  const p = relPosix(relPath).toLowerCase();
+  const base = path2.basename(p);
+  if (base.endsWith(".d.ts")) return true;
+  if (/\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs)$/.test(base) || p.includes("/__tests__/") || p.includes("/test/") || p.includes("/tests/")) {
+    return true;
+  }
+  if (p === "claude.md" || p === "agents.md" || p === "devops.md") return true;
+  if (p.startsWith("docs/") || p.includes("/docs/") || p.startsWith("scripts/") || p.includes("/scripts/") || p.startsWith("examples/") || p.includes("/examples/") || p.startsWith("artifacts/mockup-sandbox/") || p.includes("/artifacts/mockup-sandbox/")) {
+    return true;
+  }
+  return false;
+}
+function isUiLibraryPrimitive(relPath) {
+  const p = relPosix(relPath).toLowerCase();
+  return p.startsWith("components/ui/") || p.includes("/components/ui/") || p.startsWith("src/components/ui/") || p.includes("/src/components/ui/") || p.startsWith("app/components/ui/") || p.includes("/app/components/ui/") || p.startsWith("ui/") || p.includes("/shadcn/ui/");
+}
 var SERVE_INDICATORS = [
   "emitFile",
   "setHeader",
@@ -301,6 +319,1333 @@ async function isAssetEmittedDynamically(ctx, assetName) {
   return false;
 }
 
+// ../../lib/checklist-data/src/items-critical-a.ts
+var ITEMS_CRITICAL_A = [
+  {
+    id: "value-prop",
+    number: 1,
+    title: "Be able to explain what this is in one sentence",
+    category: "Product & Launch",
+    priority: "critical",
+    timeEstimate: "1 hr",
+    prompt: `Act as a sharp positioning consultant in the style of April Dunford. I'll describe my product to you. Push back if my answers are vague \u2014 keep asking until you have specifics. Then craft a one-sentence value proposition using this template: "[App] helps [specific person] [do specific thing] without [common pain]." Give me 3 alternative versions varying tone (confident, plain, slightly playful). Then write 3 supporting bullets that are outcomes, not features. Finally, draft a 60-word elevator pitch I could say out loud at a party. Before writing anything, ask me: who exactly is the target user, what do they currently use instead, and why does that current solution suck for them. Don't generate a single line of marketing copy until you have those three answers.`,
+    what: "If a stranger lands on your homepage and can't figure out what you do in five seconds, they're gone. Same if you can't answer \u201Cso what does it do?\u201D at a party without rambling. The exercise of squeezing your app into one clear sentence forces you to find the actual point.",
+    why: "Most launches don't fail from bad code \u2014 they fail because nobody understands why they should care. A clear one-line pitch is what makes someone read the second sentence.",
+    steps: [
+      'Fill in the template: "[App] helps [specific person] [do specific thing] without [common pain]." Specific beats clever every time.',
+      "Put that sentence at the very top of your homepage in big, confident text.",
+      "Add three short supporting bullets that prove it (not adjectives \u2014 actual outcomes).",
+      `Identify exactly who it's for. "Everyone" is not a target.`,
+      "Read your sentence to 5 people who don't know your app. If they can't roughly repeat it back, it's not done."
+    ],
+    redFlags: [
+      'Generic descriptions like "the best [thing] for [vague]"',
+      "You can't name a specific person it's for",
+      "Friends still don't get it after you explain twice",
+      "Your homepage talks about features instead of what changes for the user",
+      "You can't say what makes you different from the obvious alternative"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "A clear one-sentence value prop is a positioning judgment, not a code property. The scanner can detect a homepage exists; only a human can decide whether the sentence on it actually lands with target users."
+  },
+  {
+    id: "ai-audit",
+    number: 2,
+    title: "Audit what your AI builder actually shipped",
+    category: "Operations",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a senior engineer doing a code audit on a project I built mostly with AI. Walk through every file and flag anything that looks like leftover scaffolding, mock data, or unfinished work that snuck into a real user flow. Specifically search for and list, with file and line: TODO/FIXME/XXX/HACK comments; the strings 'mock', 'dummy', 'placeholder', 'lorem', 'fake', 'sample', 'stub'; hardcoded test emails (test@example.com, john.doe, jane.doe); hardcoded fake names, fake numbers, fake credit cards; functions that return the same constant regardless of input; console.log/print statements anywhere on a real request path; debug routes, /test pages, or admin shortcuts. For each finding tell me: is this real work that needs to be done, or leftover scaffolding to delete. Then pick 3 of my most important functions and walk me through line by line what they actually do, in plain English, so I can tell if they match what I think they do. Don't fix anything yet \u2014 give me the report first.",
+    what: "Your AI builder is a fast, productive contractor who occasionally lies. It will tell you 'done!' when something is actually mocked, stubbed, hardcoded, or half-built. Before you launch you need to do a literal walkthrough of your codebase looking for the patterns AI builders ship by accident.",
+    why: "Vibe-coded apps go live with placeholder users called 'John Doe', mock API responses returning the same fake data every time, TODO comments inside real flows, debug logs leaking sensitive info, and functions that return constants instead of doing the thing. None of that explodes loudly \u2014 it just quietly makes your app a lie until a real user notices.",
+    steps: [
+      "In your editor, do a project-wide search (Cmd+Shift+F or your platform's search) one string at a time: TODO, FIXME, XXX, HACK, mock, dummy, placeholder, lorem, fake, sample, stub.",
+      "For each hit, decide: real work to finish, or leftover scaffolding to delete.",
+      "Search for hardcoded test data: test@example.com, john.doe, jane.doe, 555-1234, password123. Anything that smells synthetic shouldn't be in production code.",
+      "Open an incognito window and use your app as a brand new user. Sign up. Do the main thing. Does data actually save somewhere real, or are you looking at the same fake response every time?",
+      "Pick 3 random functions and ask your AI builder: 'walk me through what this does line by line in plain English.' If the explanation is fuzzy or doesn't match what you thought it does, that's a bug waiting."
+    ],
+    redFlags: [
+      "console.log or print statements on production code paths (especially logging tokens, full user records, or request bodies)",
+      "Functions that return the same value every time regardless of input",
+      "Forms that show a success message but you can't find the saved data anywhere",
+      "Comments like 'TODO: implement this' or 'replace with real API'",
+      "Variable names like fakeUsers, mockData, or testItems being used in production paths"
+    ],
+    cliCoverage: "automated",
+    cliPrompt: {
+      whatFailed: "The scanner found content that looks like leftover scaffolding from your AI builder \u2014 TODO/FIXME/HACK comments, placeholder strings ('lorem ipsum', 'John Doe', 'test@example.com'), or console-style debug calls sitting on real code paths. These are the patterns AI builders ship by accident: a contractor that says 'done' when the work is actually mocked or unfinished.",
+      whyItBlocksLaunch: "Vibe-coded apps go live with placeholder users called 'John Doe', mock API responses returning the same fake data every time, and debug log calls leaking tokens to the server log. None of that explodes loudly \u2014 it just quietly makes your app a lie until a real user notices and screenshots it.",
+      fixInstructions: "Treat each flagged file as a decision point: is this real work that needs to be finished, or leftover scaffolding to delete? Replace mock data with real database calls. Remove debug log statements from production paths. Either implement the TODO or remove the comment. Re-run the scanner \u2014 every finding should either be gone or downgraded with a documented reason.",
+      aiBuilderPrompt: "Walk through every finding in this scan flagged under 'ai-audit'. For each one, tell me: is this real work that needs to be done, or leftover scaffolding to delete? For TODO/FIXME comments, propose what the code should actually do (don't just remove the comment if there's missing logic). For placeholder strings like 'lorem ipsum' or 'test@example.com', replace with real content or remove the surface. For debug log statements on request paths, remove them but propose proper structured logging if the trace was actually useful (use the project's logger, never raw console output on a request path).",
+      verificationStep: "Re-run `npx shippingszn` and confirm zero findings tagged `ai-audit`. Then open the app in an incognito window and use it as a brand-new user \u2014 confirm data persists somewhere real and you don't see any of the placeholder text in the live UI."
+    }
+  },
+  {
+    id: "security-scanner",
+    number: 3,
+    title: "Run the Security & Privacy Scanner",
+    category: "Security",
+    priority: "critical",
+    timeEstimate: "1 hr",
+    prompt: "Act as a senior application security engineer. Audit this entire project end-to-end for the most common ways an early-stage app gets hacked or embarrassed in public. Check for: (1) leaked secrets in code, env files, or git history; (2) outdated dependencies with known CVEs; (3) unsafe code patterns (eval, raw shell exec, SQL string concatenation, unsanitized HTML rendering); (4) any file or asset that should never be deployed (test fixtures with real user data, debug endpoints, .DS_Store, .env, sample API keys); (5) overly permissive defaults (CORS *, public S3 buckets, open admin routes). For each finding, output: severity (Critical/High/Medium/Low), one-sentence plain-English description, exact file and line, and recommended fix. Do NOT fix anything yet \u2014 give me the full report sorted by severity, then wait for me to approve fixes one batch at a time.",
+    what: "Most modern AI builders (Replit, Lovable, Bolt, Cursor, etc.) ship with a security scanner \u2014 a one-click check that goes through your whole project and looks for the common ways apps get hacked, leak data, or accidentally ship dangerous files. Think of it as a smoke detector for your code: it can't fix problems for you, but it tells you exactly where they are before your users find them.",
+    why: "You don't know what you don't know. A scanner catches the obvious dangerous stuff \u2014 leaked passwords, outdated libraries with known holes, code patterns that hackers automate against \u2014 so you stop those before opening the doors. If your builder doesn't ship one, you can run an open-source equivalent (Snyk, Semgrep) for free.",
+    steps: [
+      `Open your builder and look for a "Security Scanner," "Audit," or "Vulnerabilities" panel \u2014 it usually has its own tab. If yours doesn't have one, install Snyk or Semgrep (both free for small projects).`,
+      "Click Run and let it finish. It usually takes a few minutes; longer for big projects.",
+      "Sort by severity and look at everything marked Critical or High first. Ignore Low for now.",
+      `For each finding, click into it. The scanner explains what's wrong in plain language and often suggests a fix. If you don't understand a finding, paste it into your AI builder and ask "what does this mean and how do I fix it?"`,
+      "Re-run the scanner after each batch of fixes. You want zero Critical and as few High as possible before launch."
+    ],
+    redFlags: [
+      "Any Critical finding you can't explain in your own words",
+      `High-severity issues you're planning to "deal with later"`,
+      'A long list of "hidden" or "ignored" issues with no notes on why',
+      "Findings that show your app sending user data to companies you didn't intend",
+      "Files flagged as malicious or unsafe that you don't recognize"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "shippingszn IS the security scanner referenced by this item. Running `npx shippingszn` and reading the report is the act of completing this checklist item. Mark it complete after a clean scan + reviewing findings."
+  },
+  {
+    id: "secrets",
+    number: 4,
+    title: "Lock up your API keys and passwords",
+    category: "Security",
+    priority: "critical",
+    timeEstimate: "1 hr",
+    prompt: "Act as a security engineer. Scan my entire codebase (including config, scripts, tests, frontend, build output, and any committed .env files) for hardcoded secrets \u2014 API keys, tokens, database passwords, OAuth client secrets, webhook signing keys, JWT signing keys, anything that should be private. For each finding, tell me: file, line, what kind of secret it appears to be, and which service it's for. Then refactor every finding to read from environment variables with clear names (OPENAI_API_KEY, STRIPE_SECRET_KEY, DATABASE_URL, etc.), and update any .env.example or docs to list the required variables. Also audit runtime leakage paths: any console.log / logger call that prints req.body, req.headers, full user objects, OAuth callback params, or error objects containing tokens; any Sentry (or equivalent) breadcrumbs that capture request bodies or auth headers without scrubbing; any TODO/debug comments that quote a real key. List every secret that needs to be ROTATED at the source service because it was previously committed, shared, or logged. Never print actual secret values back to me \u2014 only references and filenames.",
+    what: "Every app you build talks to other services \u2014 Stripe for payments, OpenAI for AI, your database for data. Each of those gives you a long secret string (an API key) that proves it's you. If those strings are sitting inside your code, anyone who looks at your code can use them. That includes anyone you accidentally share a screenshot with, anyone you push to GitHub, and anyone who gets into your builder account.",
+    why: `This is the #1 way vibe-coded apps get destroyed. One leaked OpenAI key can rack up thousands of dollars over a weekend. One leaked Stripe key can let someone refund every charge you've ever made. Every modern builder gives you a place to store these safely \u2014 usually called "Secrets," "Environment Variables," or ".env" \u2014 you just have to use it.`,
+    steps: [
+      "Find the Secrets / Environment Variables panel in your builder (usually a lock or key icon in the sidebar). Replit calls it Secrets, Vercel calls them Environment Variables, Bolt calls it .env, etc.",
+      'Search your code for anything that looks like a long random string \u2014 things starting with "sk-", "AIza", or any variable named "API_KEY", "SECRET", "TOKEN", or "PASSWORD".',
+      "Run a git-history scan, not just a search through current files. Tools like gitleaks (free, one command: `gitleaks detect`) check every commit you've ever made \u2014 including ones where you 'removed' the key by editing the file. A removed key still lives in history forever, and bots scrape public GitHub for these patterns within minutes of a push.",
+      'For each one, add it to Secrets / env vars with a clear name (like OPENAI_API_KEY), then ask your AI builder: "replace the hardcoded OPENAI_API_KEY in my code with the environment variable."',
+      "Test that the app still works after the swap.",
+      "If a key was ever committed to GitHub (even a private repo), screenshot, or pasted into a chat \u2014 treat it as already-leaked. Go to that service's dashboard, regenerate the key, and update the new value in your env vars. Just deleting the old code does NOTHING \u2014 bots scan public GitHub within minutes, and 'private' repos go public by accident more than you'd guess. Rotate first, scrub history second."
+    ],
+    redFlags: [
+      "You can search your project files and find an actual API key sitting in plain text",
+      "A database connection URL with the password right in it, in code",
+      "You've pasted real keys into chats, screenshots, or AI prompts and never rotated them",
+      "Your .env or secrets file is sitting in your GitHub history",
+      "You've never run gitleaks (or any history scanner) \u2014 only searched current files"
+    ],
+    cliCoverage: "automated",
+    cliPrompt: {
+      whatFailed: "Your codebase contains what looks like a hardcoded API key or password. The scanner found a string that matches a common provider's secret format (OpenAI, Anthropic, Stripe, AWS, GitHub, etc.) sitting directly in source code or a committed config file.",
+      whyItBlocksLaunch: "A leaked production key is the single fastest way to lose money or expose user data. Public-repo secrets get scraped within minutes of being committed, and the bots that find them spin up paid API calls or exfiltrate database content before you notice. Even private repos leak \u2014 screenshots, accidental publishes, and shared chat threads all count.",
+      fixInstructions: "Move every detected secret out of source into environment variables (OPENAI_API_KEY, STRIPE_SECRET_KEY, DATABASE_URL, etc.) and read them at runtime via process.env. Add the variable names to .env.example so future runs know what to set. Then ROTATE the original secret at the provider \u2014 the leaked value must be considered compromised. Update .gitignore to exclude .env, and run gitleaks across history to catch earlier commits.",
+      aiBuilderPrompt: "Find every hardcoded secret in this project (API keys, tokens, OAuth client secrets, JWT signing keys, webhook secrets, database passwords). For each: tell me the file, the line, and what kind of secret it is. Then refactor each to read from process.env with a clear name (OPENAI_API_KEY, STRIPE_SECRET_KEY, etc.). Add every required variable to .env.example. Make sure .env is in .gitignore. List every secret value that needs to be ROTATED at the source service. Never print actual secret values back to me \u2014 only references.",
+      verificationStep: "Run `npx shippingszn` again and confirm zero findings under `secrets`. Run `gitleaks detect --source . --verbose` to scan git history. Rotate any value that ever appeared in a commit, screenshot, or chat \u2014 even removing it from current code doesn't unrotate it."
+    }
+  },
+  {
+    id: "api-spend-cap",
+    number: 5,
+    title: "Cap every AI / API spend before someone bankrupts you",
+    category: "Operations",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a senior backend engineer. Audit my app for every paid third-party API I call (OpenAI, Anthropic, Replicate, ElevenLabs, Twilio, image generation, transcription, anything per-request). For each one: (1) tell me where in the provider's dashboard to set a HARD spending cap (not just an alert) and what number to start with \u2014 recommend a sane default for an early-stage app; (2) add an in-app per-user daily and per-IP daily quota for that endpoint, returning a polite 429 when exceeded; (3) add a global kill-switch I can toggle via env var to instantly stop calls if costs spike; (4) log every paid call with user ID, route, token count or unit cost so I can see who is consuming what; (5) add a simple cost dashboard or weekly email summary. After you're done, tell me the absolute worst-case daily spend if my app got pounded by a bot.",
+    what: "Every AI API and paid third-party service charges per request. If your app calls OpenAI, Anthropic, Replicate, ElevenLabs, Twilio, or anything similar, an attacker (or a bug) can run those calls in a loop and turn your free trial into a four-figure bill overnight. Spend caps and per-user quotas are the seatbelts.",
+    why: "This is the most underrated risk for vibe-coded apps in 2026. AI builders happily wire up an OpenAI key for you with no quotas. One infinite loop, one abusive script, or one curious user can rack up $1K\u2013$10K in a weekend. The provider will not refund it. Caps cost nothing and take 10 minutes to set.",
+    steps: [
+      "Log into every paid API dashboard (OpenAI, Anthropic, Replicate, etc.) and set a HARD monthly spending cap, not just a warning email. Start low \u2014 you can raise it.",
+      "In your app, add per-user quotas: 'this user can make at most N AI requests per day.' Even logged-in users need this.",
+      "Add per-IP rate limits on AI endpoints, separate from your normal API rate limits \u2014 much stricter.",
+      "Add a global kill-switch (an env variable like AI_ENABLED=false) you can flip in 10 seconds if costs spike.",
+      "Log every paid call with user ID and rough cost so you can see who is burning money. Set up a weekly summary email."
+    ],
+    redFlags: [
+      "No spending cap set in your AI provider's dashboard",
+      "No per-user limit on your AI features \u2014 anyone signed up can call them unlimited times",
+      "AI endpoints exposed to logged-out users without strict per-IP limits",
+      "You can't quickly answer 'what's the worst case my AI bill could be tomorrow?'",
+      "No way to instantly stop AI calls if you see costs spike"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "secure-auth",
+    number: 6,
+    title: "Use a real login system, not one you wrote yourself",
+    category: "Security",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a senior application security engineer. I want to replace any custom or partial authentication in this app with a battle-tested provider. First, recommend the best fit for my stack from: Clerk, Auth0, Supabase Auth, Stytch, or my platform's built-in auth \u2014 and explain why in one paragraph. Then implement it end-to-end: signup, login, logout, password reset, email verification, session management, and protected routes (both pages and API). Use the provider's recommended secure defaults. Add server-side checks on every protected route \u2014 never trust the frontend. Add login and OTP rate limiting (max 5 attempts per 15 minutes per IP+identifier). If email or SMS one-time codes are used, normalize phone numbers to E.164, make resend/cooldown behavior explicit, use anti-enumeration responses, write clear mobile copy, verify real code delivery, and add a recovery path if paid access depends on OTP. Set session expiry to 24h of inactivity. Migrate any existing user data safely. After you're done, give me a checklist of what I need to verify in the provider dashboard before launch.",
+    what: "How users sign in, receive verification codes, recover paid access, and stay signed in. Done well, only the real user can get into their account. Done badly, an attacker can guess codes, enumerate customers, abuse SMS/email delivery, steal sessions, or read passwords straight out of your database.",
+    why: "If your login or OTP flow is weak, every other security thing you did doesn't matter \u2014 the attacker just walks in the front door or your paid users get locked out. The good news: you almost never need to build login from scratch. Use a proven provider and let shippingszn scan for the launch risks AI builders usually miss.",
+    steps: [
+      "Use a real auth provider (Clerk, Auth0, Supabase Auth, Stytch, or your platform's built-in auth like Replit Auth) instead of writing it yourself. Your AI builder can wire one up in a single prompt.",
+      "Never store passwords directly. Real auth providers store a one-way scrambled version (a hash) so even they can't read it.",
+      "Turn on rate limiting on login (max 5 wrong attempts in 15 minutes) so attackers can't sit there guessing forever.",
+      "If you use email or SMS OTP, normalize phone numbers, add resend cooldown copy, use generic success-shaped start responses, and smoke a real delivered code before launch.",
+      "If paid report or purchase access depends on OTP, add a recovery path: alternate contact, receipt/support handoff, or purchase history.",
+      "Set sessions to expire (12\u201324 hours is normal) so a stolen laptop doesn't mean a permanent account takeover.",
+      "Offer two-factor authentication (2FA) if your auth provider supports it \u2014 most do, with one toggle."
+    ],
+    redFlags: [
+      "You can see actual passwords in your database (real ones look like long random gibberish)",
+      "You can try the wrong password 100 times in a row and nothing stops you",
+      "Sessions never expire \u2014 once you log in, you're logged in forever",
+      "Your login page works over plain http://, not https://",
+      "You wrote login from scratch instead of using a provider",
+      "SMS OTP compares raw phone strings instead of normalized E.164 numbers",
+      "The OTP start screen reveals whether an email, phone, purchase, or report exists",
+      "Paid users have no fallback when the email or SMS code does not arrive",
+      "Session cookies missing HttpOnly, Secure, or SameSite (check Application \u2192 Cookies in dev tools)"
+    ],
+    cliCoverage: "automated",
+    cliPrompt: {
+      whatFailed: "The scanner found gaps in your authentication or one-time-code (OTP) flow. Common detections: phone numbers compared as raw strings instead of normalized E.164, missing resend/cooldown copy on OTP screens, anti-enumeration responses that reveal whether an account exists, no recovery path when paid access depends on OTP, no mobile one-time-code input attribute, or no evidence of a real delivered-code smoke test.",
+      whyItBlocksLaunch: "Auth and OTP bugs are the #1 way paid users get locked out of products they paid for. A user who can't receive their login code on launch day is a refund and a lifetime negative review. An OTP flow that reveals existing accounts is a free customer list for attackers. These bugs are invisible until production traffic hits.",
+      fixInstructions: "Use a real auth provider (Clerk, Auth0, Stytch, Supabase Auth) instead of a hand-rolled flow. Normalize phone numbers to E.164 before storing or comparing. Add explicit resend-cooldown copy on the OTP screen. Use generic 'we sent a code if that account exists' responses (anti-enumeration). Add inputmode=numeric and autocomplete=one-time-code to the mobile input. Test a real delivered code from production-similar settings before launch. Add a recovery path (alternate contact, support handoff) if paid access ever depends on OTP.",
+      aiBuilderPrompt: 'Audit this app\'s authentication and OTP flow against the shippingszn `secure-auth` checks. (1) Replace any hand-rolled login with Clerk/Auth0/Stytch/Supabase Auth. (2) Normalize all phone numbers to E.164 at the boundary. (3) Add resend-with-cooldown copy on the OTP screen. (4) Make the OTP-start response identical whether the account exists or not. (5) Add `inputmode="numeric"` and `autocomplete="one-time-code"` to the OTP input. (6) Add a recovery path for users who can\'t receive OTP and have already paid. (7) Verify session cookies are HttpOnly + Secure + SameSite=Lax. Show me the diff before applying.',
+      verificationStep: "Send yourself a real OTP from production-similar settings \u2014 confirm it lands in inbox/SMS within 60 seconds. Try the wrong code 6 times \u2014 confirm rate limiting kicks in. Try an account that doesn't exist \u2014 confirm the start screen looks identical to the success path. Re-run the scanner and confirm `secure-auth` is clean."
+    }
+  },
+  {
+    id: "common-attacks",
+    number: 7,
+    title: "Block the most common automated attacks",
+    category: "Security",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a security auditor. Audit my full app against the OWASP Top 10, focusing on: (1) SQL injection \u2014 find any place I'm building queries with string concatenation or user input that bypasses my ORM's parameterization; (2) NoSQL injection (Mongo, Firestore) \u2014 any place user input becomes a filter object without validation; (3) command injection \u2014 any place user input reaches a shell-invocation API in my language (Node shelling out, Python shell wrappers, Ruby backticks, etc.); (4) LDAP injection if I talk to a directory service; (5) XSS \u2014 find any place user input is rendered as HTML without escaping (innerHTML, raw HTML props, v-html, raw template interpolation, legacy doc-write APIs); (6) CSRF \u2014 find any state-changing endpoint without CSRF protection or SameSite cookies; (7) SSRF \u2014 find any place user input becomes a URL my server fetches; (8) insecure deserialization; (9) open redirects; (10) file upload handling \u2014 verify every upload path enforces a MIME allowlist, max size, path-traversal-safe filenames, and stores outside the web root (or on object storage with no public list); (11) verbose error responses \u2014 verify NODE_ENV (or equivalent) is 'production' in production and no stack trace, ORM dump, or absolute file path ever leaks to an end-user response body. For each finding: file, line, severity, plain-English explanation, exact fix. Apply the fixes after listing them. Then add a Content Security Policy header tuned to my actual asset sources \u2014 no wildcards, minimal unsafe-inline, justify any exception.",
+    what: "There are a handful of attacks that bots constantly run against every site on the internet. They have ugly names \u2014 XSS, SQL injection, CSRF \u2014 but the idea is simple: they trick your app into running code or queries it shouldn't. Modern frameworks have built-in defenses; you just have to use them correctly.",
+    why: "These bots don't care who you are. They scan the entire internet looking for sites that forgot to defend. If yours is one of those, your data ends up dumped on a forum, your users get hijacked, and you find out by reading about yourself online.",
+    steps: [
+      "Never paste user input directly into a database query. Use the safe parameterized version your framework provides (your AI builder knows how \u2014 ask it).",
+      "Never paste user input directly into HTML you display to other users. Frameworks like React handle this safely by default \u2014 don't disable that behavior.",
+      "Add a Content Security Policy header (your AI builder can set this up in one prompt) that tells browsers what code they're allowed to run.",
+      "Use anti-CSRF tokens on forms that change data, if your auth provider doesn't already handle them.",
+      'Ask your AI builder: "audit my app for XSS, SQL injection, and CSRF vulnerabilities and fix any you find."'
+    ],
+    redFlags: [
+      "Anywhere you're building SQL queries by gluing strings together",
+      "Anywhere user input gets shown back to other users without going through the framework's safe rendering",
+      "Your framework is showing security warnings in the console you've been ignoring",
+      "Forms that change data (delete, update, transfer money) work fine when called from random other websites"
+    ],
+    cliCoverage: "automated",
+    cliPrompt: {
+      whatFailed: "The scanner caught a code pattern that maps to a well-known automated attack: unsafe HTML rendering (XSS), wildcard CORS (any origin can call your API), runtime code-execution calls, or a SQL/NoSQL query built from string concatenation instead of parameterization.",
+      whyItBlocksLaunch: "These are not theoretical. Bots scan the entire internet looking for sites that forgot to use the framework's safe defaults. Your app is one bot away from a stolen session, a hijacked admin route, or a customer-data dump on a forum. The fix is almost always a one-line change to use the framework's safe primitive instead of the raw one.",
+      fixInstructions: "Replace unsafe HTML rendering APIs (innerHTML, raw HTML props, v-html, legacy doc-write APIs) with the framework's safe interpolation (React's default {}, Vue's {{ }}, etc.). Replace wildcard CORS (`*`) with an explicit allowlist of trusted origins. Eliminate runtime code-execution calls \u2014 there is almost always a parser or DSL that does the job safely. Use parameterized queries everywhere \u2014 never glue strings into SQL/NoSQL filters. Add a Content Security Policy header tuned to your actual asset origins.",
+      aiBuilderPrompt: "Audit every finding in this scan tagged `common-attacks`. For each: explain in plain English what the attack is, show me the exact line, and apply the smallest safe fix \u2014 escape HTML rather than disabling sanitization, parameterize queries rather than string-glue, narrow CORS to the actual production origin(s), replace runtime code-execution calls with a typed parser. Also add a Content Security Policy header that allowlists ONLY my actual asset origins (no wildcards, minimal unsafe-inline, justify every exception). Show me the diff before applying.",
+      verificationStep: "Re-run the scanner and confirm zero findings tagged `common-attacks`. In the deployed app, open dev-tools Network and confirm responses include a tight CSP header. Try posting a `<script>alert(1)</script>` payload anywhere user content is rendered \u2014 confirm it shows as text, not as an executed alert."
+    }
+  }
+];
+
+// ../../lib/checklist-data/src/items-critical-b.ts
+var ITEMS_CRITICAL_B = [
+  {
+    id: "https-headers",
+    number: 8,
+    title: "Force HTTPS and add browser-level defenses",
+    category: "Security",
+    priority: "critical",
+    timeEstimate: "1 hr",
+    prompt: "Act as a security engineer. Set my app up with production-grade security headers. Add: Strict-Transport-Security (HSTS) with includeSubDomains and a 1-year max-age once I'm confident; Content-Security-Policy tuned to the actual scripts/styles/images/fonts/connections my app uses (no wildcards, no unsafe-inline unless I explicitly approve it \u2014 list each exception with a justification); X-Content-Type-Options: nosniff; X-Frame-Options: DENY (or SAMEORIGIN if I embed my own pages \u2014 ask me); Referrer-Policy: strict-origin-when-cross-origin; Permissions-Policy disabling features I don't use (camera, microphone, geolocation, etc.). Add an application-level http\u2192https redirect as a backup to platform HTTPS. After you're done, tell me what to test at securityheaders.com and what grade I should expect.",
+    what: "HTTPS is the little padlock in the browser bar. It encrypts everything between your user and your server, so people sharing the same WiFi can't read passwords as they're being typed. Security headers are extra instructions you send to the browser saying \u201Cnever trust content claiming to be from me unless it really is.\u201D",
+    why: "Without HTTPS, anyone on the same coffee-shop WiFi can read your users' passwords as plaintext. Without security headers, attackers can wrap your site inside theirs (clickjacking) or trick browsers into running malicious scripts. The fixes are basically free.",
+    steps: [
+      "Most modern hosting (Replit, Vercel, Netlify, Cloudflare Pages, Railway) gives you HTTPS automatically when you publish \u2014 confirm the lock icon shows up in the browser bar.",
+      "Set up an automatic redirect from http:// to https:// so no one accidentally lands on the unencrypted version.",
+      "Add a Content-Security-Policy header that locks down where your scripts, images, and fonts are allowed to come from.",
+      "Add X-Content-Type-Options: nosniff and X-Frame-Options: DENY (or SAMEORIGIN if you embed your own pages).",
+      "Test your site at https://securityheaders.com \u2014 aim for at least an A grade."
+    ],
+    redFlags: [
+      "Any page on your site that loads over plain http:// in production",
+      "A grade of D or F on securityheaders.com",
+      "Other websites can put your app in an iframe (potential clickjacking)",
+      "Browser console shows mixed-content warnings"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "dev-prod-data",
+    number: 9,
+    title: "Keep your test data away from real users",
+    category: "Infrastructure",
+    priority: "critical",
+    timeEstimate: "30 min",
+    prompt: 'Act as a senior infrastructure engineer. Audit my project to confirm development and production are properly separated. Verify: (1) my dev workspace connects to a dev database, NOT production; (2) my production deployment uses production-only environment variables; (3) seed scripts, fixtures, and mock data are excluded from production; (4) destructive scripts (drop tables, wipe data, factory reset) cannot run in production by accident \u2014 add an explicit guard that fails if NODE_ENV is "production" unless I pass a confirmation flag; (5) any analytics/error monitoring is properly tagged by environment so I can tell dev noise from real production events. Tell me exactly which database my code reads from in each context. If anything is misconfigured, fix it and explain in plain English what was wrong.',
+    what: "Two databases: one to mess around with while you build (development), one that holds your actual users' actual data (production). They should never touch each other. Most modern builders and hosted database services (Replit, Supabase, Neon, PlanetScale) set you up with both automatically when you publish.",
+    why: "If you point a half-broken in-progress feature at the real database, you can corrupt or wipe real user data with one bad query. If you copy real user data into your dev environment, you've taken a privacy obligation and made it more likely to leak. Keep them apart.",
+    steps: [
+      "Know which is which: the database in your workspace is dev. The one your published app uses is prod.",
+      "Never paste production database credentials into your dev workspace.",
+      "When testing destructive features (delete account, bulk update, mass email), only test against dev data.",
+      "If you ever need a slice of prod data for debugging, scrub names, emails, and any personal info first.",
+      "Read your platform's docs on production databases so you know how to push schema changes (new tables, renamed columns) safely. Most have a one-page guide \u2014 the link below is Replit's, as one example."
+    ],
+    redFlags: [
+      `You can't answer "which database is my live app reading from right now?"`,
+      "Your in-progress code points at the production database",
+      'You manually edit production data ("just one quick fix") with no rollback plan',
+      "You've copied real production data to your dev environment without scrubbing",
+      "Schema changes (new tables, renamed columns) go live without ever being tested first"
+    ],
+    references: [
+      {
+        label: "Example: Replit production databases",
+        url: "https://docs.replit.com/cloud-services/storage-and-databases/sql-database"
+      }
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "backups",
+    number: 10,
+    title: "Back up your database \u2014 and actually test the restore",
+    category: "Infrastructure",
+    priority: "critical",
+    timeEstimate: "1 hr",
+    prompt: "Act as a senior infrastructure engineer. Tell me, for my specific database setup, exactly: (1) is automatic point-in-time backup turned on, and how far back can I restore? (2) where the backups physically live and who can access them; (3) the EXACT click-by-click procedure to restore my database to a point 24 hours ago in a non-destructive way (clone first, swap if good, never restore in place blind). Then walk me through ACTUALLY DOING a test restore right now to a clone \u2014 not in theory, in practice \u2014 so I know it works before I need it. Also recommend an additional manual backup strategy (weekly export to object storage I control) so I'm not 100% dependent on my host. Output a one-page DISASTER_RECOVERY.md I can keep with my project.",
+    what: "An automatic, recent copy of your entire database stored somewhere safe \u2014 and the ability to restore from it without panicking. Most managed databases (Neon, Supabase, Replit DB, RDS, PlanetScale) include some form of backup, but defaults vary, and 'a backup exists' is not the same thing as 'a backup that works.'",
+    why: "Sooner or later you, your AI builder, or a script will run the wrong query against the production database. Without a tested backup, your only options are 'rebuild from memory' and 'apologize to users in public.' With one, it's a 10-minute fix. The whole point of doing this BEFORE launch is that nobody is depending on the data yet \u2014 so testing the restore is free.",
+    steps: [
+      "Open your database's dashboard (Neon, Supabase, Replit, etc.) and find the Backups or Point-in-time Recovery section. Confirm automatic backups are on, and note how many days you can restore back.",
+      "Actually do a test restore \u2014 to a clone, not your real database. Most providers let you spin up a copy from a backup in one click. Do it once before launch so you know how.",
+      "Before any production schema migration \u2014 adding/dropping columns, renaming tables, changing constraints \u2014 take a fresh point-in-time snapshot first. 30 seconds of clicking now beats 6 hours of manually reconstructing data at midnight when the migration eats a column it shouldn't have. Make this a habit, not a launch-day-only thing.",
+      "Set yourself a calendar reminder for a weekly manual export (most ORMs and DBs have a one-line dump command), saved somewhere you control (object storage, your laptop). Defense in depth.",
+      "Write a one-page note (DISASTER_RECOVERY.md) for future-you: where backups live, exact steps to restore, who to call. Put it next to your code.",
+      "NEVER restore directly over your live database without first restoring to a clone and confirming it has what you expected."
+    ],
+    redFlags: [
+      "You don't actually know whether automatic backups are on for your database",
+      "You've never performed a restore \u2014 only assumed it would work",
+      "You run schema migrations against production without taking a fresh snapshot first",
+      "Backups stored in the same account as the database (one compromised login = both gone)",
+      "No documented procedure \u2014 when disaster strikes, you'll improvise badly",
+      "Retention is 24 hours or less (one missed day and you're cooked)"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "The scanner can detect a docs/RECOVER.md (covered by extended internal-audit checks) but cannot confirm the documented procedure has been tested against a real restore. Owner must run the drill once before launch."
+  },
+  {
+    id: "secure-api",
+    number: 11,
+    title: "Lock down your app's behind-the-scenes URLs",
+    category: "Security",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a backend security engineer. Go through every API endpoint in my app and check two things for each: (1) authentication \u2014 is the user logged in? (2) authorization \u2014 is THIS user allowed to access THIS specific resource? (the IDOR check). Pay especially close attention to endpoints that use IDs from the URL like /users/:id or /orders/:id \u2014 these are the most commonly broken. Output a table per endpoint: route, method, requires login? (Y/N), checks resource ownership? (Y/N), risk level. Then fix every endpoint that's missing checks. Add input validation (Zod, Yup, or my framework's equivalent) to every endpoint \u2014 validate types, ranges, lengths, formats. Lock down CORS to my own domain \u2014 no wildcards in production. After fixes, give me 3 curl commands I can run to verify a logged-out user, a regular logged-in user, and another user's account all get blocked appropriately.",
+    what: "Your app has a frontend (what users see) and a backend (the URLs the frontend calls to load and save data \u2014 these are called API endpoints). If those backend URLs aren't checking who's asking and what they're allowed to do, anyone with browser developer tools can call them directly and do whatever they want.",
+    why: 'This is one of the most common silent disasters in vibe-coded apps: the frontend hides the "delete account" button from non-admins, but the backend lets anyone call /api/delete-account if they know the URL. The button is decoration; the backend check is the actual lock.',
+    steps: [
+      'Every endpoint that touches user data should check: "is this person logged in?"',
+      `Every endpoint that touches a specific user's data should also check: "is this person allowed to access THIS user's data?" This is the most commonly missed step.`,
+      "Validate every input on the backend \u2014 don't trust the frontend to send you clean data.",
+      `Ask your AI builder: "go through every API endpoint in my project and tell me which ones don't check authentication or authorization, and fix them."`,
+      "Set up CORS so only your own frontend can call your backend."
+    ],
+    redFlags: [
+      "Admin functions you can call from a logged-out browser",
+      "You can change the user ID in a URL (/api/users/123 \u2192 /api/users/124) and read someone else's data",
+      "Your backend trusts whatever the frontend sends without re-checking it",
+      "CORS is wide open (Access-Control-Allow-Origin: *) on a non-public API"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "access-control",
+    number: 12,
+    title: "Decide who's allowed to do what",
+    category: "Security",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a senior backend engineer. Help me design and implement a clean role/permission model. First, ask me what user types my app has (e.g., owner, admin, member, free, paid). Then create a single source of truth for permissions \u2014 either a permissions matrix or a function like can(user, action, resource) \u2014 and wire EVERY sensitive route, mutation, and UI element through it. Default to deny \u2014 only allow what's explicitly granted. Hide UI elements based on permissions, but ALSO enforce them server-side (frontend hiding is never a security control). Document the model in a short PERMISSIONS.md so future-me can read it. After you're done, write 5 manual test cases I can run to confirm a regular user can't access admin functionality by URL guessing or modifying request payloads.",
+    what: "Most apps have at least two kinds of users \u2014 regular users and admins (you). Some have more (free vs. paid, owners vs. members, etc.). Access control is the rules that say \u201Cthis person can do this, but not that.\u201D Without it, a curious user can stumble into pages or actions they shouldn't have.",
+    why: "The classic disaster: a regular user discovers /admin still works for them, deletes a few records to see what happens, and now you have angry users and no backups. Or, more quietly: paid features accidentally available to free users, costing you revenue.",
+    steps: [
+      "Make a list: what types of users does your app have? (Owner, admin, member, guest, free, paid.)",
+      "For each sensitive action (edit, delete, view billing, invite), write down who is allowed.",
+      "Enforce those rules on the backend, not just by hiding buttons on the frontend.",
+      "Default to no access \u2014 only grant what someone explicitly needs.",
+      "Try to break it: log in as a regular user and try to access admin URLs directly. Try to access another user's data by changing IDs. If anything works that shouldn't, fix it."
+    ],
+    redFlags: [
+      "You only enforce permissions by hiding buttons on the frontend",
+      "Changing an ID in a URL gives you access to data you shouldn't see",
+      "Free users can hit paid features by guessing URLs",
+      `There's no clear list anywhere of "admin can do X, regular user can do Y"`
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Role-based access boundaries (admin can do X but user cannot) need a runtime test with two real accounts. Code review alone misses bugs in auth-middleware ordering."
+  },
+  {
+    id: "legal-pages",
+    number: 13,
+    title: "Add real Terms and Privacy pages (don't fake these)",
+    category: "Product & Launch",
+    priority: "critical",
+    timeEstimate: "1 hr",
+    prompt: 'Act as a product engineer. Add /terms and /privacy pages to my app. IMPORTANT: do not invent legal language. Instead, generate a structured outline of every section that needs to exist in each page, customized to what my app actually does. Detect what to include by inspecting my dependencies and code \u2014 list every third-party service I integrate (Stripe, OpenAI, Google Analytics, Resend, Sentry, etc.) and note which ones need to be disclosed in the privacy policy. Output the outline as headings with a 1-sentence description of what each section should cover. Add a clear banner at the top of each page: "This is a starting outline. Get the actual legal language from a lawyer or a service like Termly, iubenda, or Termageddon." Then add the page routes, link them from the footer / signup / cookie banner, and include an "Effective date" field and a real contact email.',
+    what: "Two pages most apps need: Terms of Service (the rules of using your app) and a Privacy Policy (what data you collect and what you do with it). They are legal documents \u2014 the words matter, and they have to actually describe what your app does.",
+    why: "These protect you from getting sued and protect your users from being misled. Most platforms (App Store, Google, Stripe, even Google sign-in) require them. Generated or copy-pasted policies that don't match your actual product are worse than nothing \u2014 they're evidence in a lawsuit.",
+    steps: [
+      "Do not have an AI write your final legal pages. Use a reputable template service (Termly, iubenda, Termageddon) or pay an actual attorney for a few hours.",
+      "Tailor whatever template you use to match what your app actually does \u2014 every third-party service you use (analytics, AI, payments, email) probably needs to be mentioned.",
+      "Create /terms and /privacy pages and link them from the footer, signup, and any place you collect data.",
+      "Include an effective date and a real way to contact you.",
+      "If you collect cookies or run analytics, add a cookie banner where required (especially in the EU and UK)."
+    ],
+    redFlags: [
+      "No terms or privacy page at all",
+      "AI-generated policies that talk about features your app doesn't have",
+      "Pages copied from another company (with their company name still in there)",
+      "No effective date, no contact info",
+      "Your privacy policy doesn't mention services you actually use (Stripe, OpenAI, Google Analytics, etc.)"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "account-deletion",
+    number: 14,
+    title: "Give users a way to delete their account and export their data",
+    category: "Product & Launch",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a privacy-aware product engineer. Add two flows to my app: (1) Account deletion \u2014 a button in account settings that, when confirmed (with a second-step modal), permanently deletes the user, all their personal data, and all their content, with a 7-day grace period during which the account can be recovered. After 7 days, the deletion is hard. Email confirmation when initiated and when finalized. (2) Data export \u2014 a button that emails the user a downloadable JSON or CSV of all their personal data and content within 24 hours. Audit my schema and tell me which tables/columns count as 'personal data' and need to be included. Make sure the deletion respects foreign-key constraints and removes data from any third party I forward to (Stripe customer, email provider, analytics). Don't break referential integrity for OTHER users (e.g., comments by deleted user become 'deleted user' instead of cascading). Output a short DATA_RIGHTS.md describing what's deleted and what's retained for legal reasons.",
+    what: "Two buttons in account settings: 'Download my data' and 'Delete my account.' One emails the user a copy of everything you have on them; the other actually removes them. Both are required almost everywhere personal data is regulated, and both are missing from almost every vibe-coded app.",
+    why: "GDPR (EU), CCPA (California), and an expanding list of US state laws make these legally required if you have any users in those places \u2014 which you will, because the internet is global. Beyond legal: it's the right thing, it builds trust, and it costs basically nothing to add now versus a panicked weekend later when someone files a complaint.",
+    steps: [
+      "Add a 'Delete my account' button in account settings. Require a second confirmation step ('type DELETE to confirm') so it's not accidental.",
+      "Implement a 7-day grace period: the account is disabled immediately, deleted permanently after 7 days. Email the user when each happens.",
+      "Make sure deletion removes their data from EVERY system: your database, your email provider's contact list, Stripe customer record, analytics, error monitoring. List these in code so future-you remembers.",
+      "Add a 'Download my data' button that emails them a JSON or CSV export of everything you have on them within 24 hours.",
+      "Write a short page (linked from privacy policy and account settings) explaining what gets deleted, what's kept and why (e.g., financial records you must legally retain), and how long it all takes."
+    ],
+    redFlags: [
+      "No way for a user to delete their account from inside the app",
+      "Deleting an account leaves their data in your database 'just in case'",
+      "Deleting an account removes them from your DB but not from Stripe / your email tool / your analytics",
+      "No way for a user to get a copy of their data",
+      "You'd genuinely struggle to comply if a user emailed you tomorrow asking to be deleted"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "A delete-account endpoint can exist in code without working end-to-end (cascade handling, third-party deletions, grace period, confirmation flow). Run the flow with a test account and confirm every related row is gone."
+  },
+  {
+    id: "consent-banner",
+    number: 15,
+    title: "Add a cookie / consent banner if you have any non-US traffic",
+    category: "Product & Launch",
+    priority: "critical",
+    timeEstimate: "1 hr",
+    prompt: "Act as a privacy-compliance engineer. Add a GDPR/CCPA-compliant consent banner to my app. Requirements: (1) shows on first visit; (2) clearly distinguishes 'strictly necessary' cookies (always on, no consent needed) from 'analytics/marketing/advertising' (off by default \u2014 explicit opt-in); (3) BEFORE consent, no analytics, no third-party trackers, no advertising pixels load \u2014 only essential auth/session cookies; (4) AFTER consent, the chosen categories load. Use a reputable open-source library (CookieConsent, Klaro) or a service (Cookiebot, Termly's banner). Inventory every cookie and tracker my app currently sets \u2014 list them in the banner UI by category. Give users a persistent way to change their choice later (footer link). Don't fake the 'reject all' button \u2014 it has to actually do nothing. Document each cookie in the privacy policy.",
+    what: "A small banner that asks visitors before you load analytics, ad pixels, or any non-essential tracking. Required by law in the EU and UK (GDPR/ePrivacy), and increasingly in California, Brazil, Canada, and a growing list of US states. Even if your business is US-only, the moment one person from London visits your site, you're inside their rules.",
+    why: "Fines for missing consent banners are real \u2014 up to 4% of global revenue under GDPR \u2014 and enforcement against small sites has ramped up. Even before fines, app stores, ad networks, and analytics tools (Google in particular) increasingly require valid consent signals before they'll work properly.",
+    steps: [
+      "Use a battle-tested library: CookieConsent (open-source, free), Klaro, or a service like Cookiebot or Termly. Don't build this from scratch.",
+      "Inventory every cookie and tracker your app sets. Group into 'Strictly necessary' (auth, session \u2014 always on) and 'Analytics & marketing' (off by default).",
+      "Block analytics scripts, ad pixels, and any third-party tracker from loading until the user opts in. Most consent libraries handle this if wired correctly.",
+      "Make 'Reject all' a single click and equally prominent as 'Accept all.' Dark patterns ('Accept all' is a big button, 'Reject' is hidden) are themselves illegal.",
+      "Add a persistent way to change consent later \u2014 usually a footer link like 'Cookie preferences.'"
+    ],
+    redFlags: [
+      "No consent banner at all and you have non-US users",
+      "Analytics or ad pixels load before the user has accepted",
+      "'Reject all' button is hidden, missing, or styled to look unclickable",
+      "Banner has only an 'OK' button \u2014 that's not consent, that's notice",
+      "You can't list every cookie your site sets and what each one does"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Whether a consent banner is required depends on what tracking cookies the live app sets and which jurisdictions you serve. Runtime + legal call, not a code property."
+  },
+  {
+    id: "payments",
+    number: 16,
+    title: "Make sure payments actually work before you charge people",
+    category: "Product & Launch",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a payments engineer. Audit my app's entire paid flow before launch. First, identify whether I use Stripe, Lemon Squeezy, Paddle, RevenueCat, app-store payments, or something else. Then verify and fix: (1) checkout can be created only by the server, never with a client-supplied price or product; (2) the success page does NOT unlock paid access just because the URL says success; it checks the backend for a paid order; (3) webhooks verify the provider signature and persist paid status, receipt ID, amount, currency, and customer email; (4) every paid product, subscription, upgrade, cancellation, refund, and failed-payment state has a real user-facing path; (5) test-mode checkout, webhook delivery, receipt email, refund, and cancellation all work end-to-end. Output exact test-card steps, webhook setup steps, env vars, and the one thing I should click in the provider dashboard to prove money would actually move.",
+    what: "If your app charges money, the payment flow is not 'done' when the checkout button opens. It is done when payment succeeds, your backend hears the signed webhook, paid access unlocks, the receipt lands, and cancellation/refund paths do not strand the user.",
+    why: "This is where vibe-coded apps embarrass themselves fast. A founder launches, someone pays, the success page lies, the webhook never arrives, and now the first customer is both confused and charged. Or worse: a user edits a client-side price and buys the expensive thing for $0. Payments need a real dry run before launch day.",
+    steps: [
+      "Run a full test-mode checkout from a logged-out or brand-new account. Pay with the provider's test card and confirm the success page shows the right purchased thing.",
+      "Verify paid access comes from your backend's recorded payment state, not from a success URL, localStorage flag, or client-side boolean.",
+      "Open the provider dashboard and confirm the webhook endpoint is live, signing is verified in code, and the event was delivered successfully.",
+      "Test the unhappy paths: failed card, duplicate click, refresh after checkout, refund, cancellation, expired subscription, and trying to access paid content before the webhook arrives.",
+      "Send yourself the receipt or confirmation email and confirm it lands in the inbox with the right amount, product, support contact, and refund/cancel instructions."
+    ],
+    redFlags: [
+      "The frontend sends the price, plan, or product ID and the backend trusts it",
+      "Paid access unlocks just because the browser landed on /success",
+      "No webhook handler, or a webhook handler that does not verify provider signatures",
+      "You have never tested refund, cancellation, failed card, or duplicate checkout",
+      "A customer could pay and have no obvious way to get help if access does not unlock"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "file-uploads",
+    number: 17,
+    title: "Lock down uploads and private files",
+    category: "Security",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as an application security engineer. Audit every place my app accepts, stores, processes, previews, or downloads user files. For each upload path, verify and fix: (1) max file size and per-user storage quota; (2) MIME/type allowlist checked on the server, not only by file extension; (3) dangerous files rejected or sandboxed (HTML, SVG with scripts, executables, archives if not needed); (4) filenames normalized so path traversal like ../ cannot work; (5) private files stored outside the public web root or in object storage with private buckets and signed, expiring URLs; (6) image/document processing strips metadata where appropriate and cannot execute embedded code; (7) antivirus or malware scanning is added if users can share files with others. Output every upload route, who can access each file afterward, and exact manual tests I should run before launch.",
+    what: "Uploads are any file a user can give your app: avatars, PDFs, CSVs, images, documents, audio, exports, attachments. They look harmless until one private upload becomes public, one huge file knocks over your server, or one malicious file gets served back to another user.",
+    why: "AI builders love to wire 'upload a file' in one prompt and skip the boring safety rails. That means public buckets, unlimited file sizes, trusting .jpg extensions, and download URLs anyone can guess. If users trust you with files, you need to prove those files stay private and bounded.",
+    steps: [
+      "List every upload entry point: avatar, import, support attachment, chat file, document, CSV, admin upload, anything.",
+      "Set hard limits: allowed file types, max file size, per-user storage quota, and max number of files per object or account.",
+      "Validate type on the server using MIME sniffing or file magic, not just the browser's accept attribute or the filename extension.",
+      "Store private files in a private bucket and serve them through signed, short-lived URLs after checking the current user is allowed to read that exact file.",
+      "Try to break it: upload a huge file, a renamed .exe, an HTML file, an SVG with script, a filename with ../, and another user's file URL. All should fail safely."
+    ],
+    redFlags: [
+      "Uploads go directly into a public /uploads folder or public object-storage bucket",
+      "Only the frontend checks allowed file types",
+      "No max file size or storage quota",
+      "Anyone with the URL can view another user's supposedly private file",
+      "Uploaded SVG/HTML files are served back as executable browser content"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "ai-guardrails",
+    number: 18,
+    title: "Put guardrails around AI outputs and actions",
+    category: "Security",
+    priority: "critical",
+    timeEstimate: "2 hr+",
+    prompt: "Act as an AI application security engineer. Audit every LLM, agent, tool-calling, retrieval, and generated-content flow in my app. Verify and fix: (1) user prompts, uploaded files, retrieved documents, and web pages are treated as untrusted input; (2) prompt injection cannot make the model reveal secrets, system prompts, hidden context, or other users' data; (3) any tool/action the AI can trigger has an explicit allowlist, server-side permission check, spending limit, and human confirmation for destructive or external actions; (4) model outputs shown to users are labeled, validated, and safe-failed when confidence is low; (5) logs do not store sensitive prompts or private documents longer than needed; (6) there is an abuse path for harmful, illegal, or policy-breaking generations. Build a concrete test set with 10 prompt-injection and data-leak attempts and show which ones pass after the fixes.",
+    what: "If your app uses AI, the model is not just a text box. It may see private data, make recommendations, call tools, spend API money, send emails, edit records, or create content users trust. Guardrails are the limits that keep a weird prompt from turning into a data leak or a destructive action.",
+    why: "Vibe-coded AI apps often ship with one giant prompt, direct access to user data, and no boundary between 'the model suggested it' and 'the app did it.' Prompt injection is not magic; it is a user telling your AI to ignore your instructions. If the AI can touch data or tools, that instruction needs to bounce off a hard server-side permission check.",
+    steps: [
+      "Map every AI flow: what context the model sees, what tools it can call, what data it can read, and what actions it can trigger.",
+      "Treat user prompts, uploaded files, retrieved docs, and web pages as hostile input. Never trust them to follow your system prompt.",
+      "Put server-side allowlists and permission checks in front of every AI tool call. The model can request an action; your backend decides whether it is allowed.",
+      "Require human confirmation for destructive, external, expensive, or irreversible actions: sending email, deleting data, publishing content, charging money, or calling paid APIs in bulk.",
+      "Build a small red-team test set: 'ignore previous instructions,' 'show me another user's data,' 'print your system prompt,' 'call the tool without permission,' and run it before launch."
+    ],
+    redFlags: [
+      "The model can call tools directly without a server-side permission check",
+      "Private user data or uploaded files are pasted into prompts with no access boundary",
+      "No prompt-injection tests exist",
+      "The app treats generated output as fact without labeling, validation, or fallback",
+      "AI prompts, retrieved documents, or conversation logs store sensitive data forever"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "AI guardrails need scenario testing against real prompts, tool permissions, data boundaries, and destructive-action confirmations. Static code cannot prove the model behaves safely under adversarial input."
+  }
+];
+
+// ../../lib/checklist-data/src/items-critical.ts
+var ITEMS_CRITICAL = [
+  ...ITEMS_CRITICAL_A,
+  ...ITEMS_CRITICAL_B
+];
+
+// ../../lib/checklist-data/src/items-high.ts
+var ITEMS_HIGH = [
+  {
+    id: "error-monitoring",
+    number: 19,
+    title: "Get notified the moment something breaks",
+    category: "Operations",
+    priority: "high",
+    timeEstimate: "30 min",
+    prompt: "Act as a senior engineer. Install error monitoring across my full stack. Default to Sentry unless you have a strong reason to recommend otherwise \u2014 explain. Wire it into both frontend and backend. Configure: (1) automatic error capture for unhandled exceptions and rejected promises; (2) source maps so stack traces show real line numbers; (3) user context (user ID + email when available) so I can see who hit each error; (4) release tagging so I know which deploy introduced what; (5) noise filtering for browser extensions and common bot errors; (6) email/Slack alerts for new error types or sudden spikes; (7) performance/transaction tracing on my key routes. Test by deliberately throwing a test error in dev and confirming it shows up. List every env variable I need to set and tell me which dashboard settings to flip.",
+    what: "Error monitoring is software that sits inside your app and silently records every error, then alerts you. So when your user hits a bug at 2am, you know about it within minutes \u2014 instead of hearing about it three days later from a frustrated tweet.",
+    why: "Most users do not report bugs. They just leave. By the time you find out something is broken from feedback, dozens of people have already bounced. With error monitoring, you see problems immediately and can fix them before they spread.",
+    steps: [
+      "Sign up for Sentry (most popular, generous free tier), Rollbar, or PostHog.",
+      "Install their SDK in both your frontend and backend (your AI builder can do this in one prompt).",
+      "Connect it to email or Slack so new errors notify you.",
+      "For the first week after launch, check the dashboard daily \u2014 fix recurring errors before they pile up.",
+      "Configure it to ignore known noise (browser extensions, bots) so real signal stands out."
+    ],
+    redFlags: [
+      "The same error happening to dozens of users without anyone telling you",
+      "Errors trending upward week over week",
+      "Database connection failures showing up regularly",
+      "No one has looked at the error dashboard in over a week"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "uptime-monitoring",
+    number: 20,
+    title: "Get pinged the moment your app goes completely down",
+    category: "Operations",
+    priority: "high",
+    timeEstimate: "30 min",
+    prompt: "Act as an SRE. Set me up with external uptime monitoring on my production URL (and any other critical surfaces \u2014 API health endpoint, login page, marketing site). Use Better Stack, UptimeRobot, or Pingdom \u2014 recommend one in 2 sentences. Configure: (1) check every 1-3 minutes from at least 3 geographic regions; (2) alerts to BOTH email and SMS / Slack \u2014 pick whatever I'll actually see at 2am; (3) require 2 consecutive failed checks before alerting (avoid false alarms from a single blip); (4) a public status page so users can self-serve when something is broken (most providers include this free); (5) add a simple /health endpoint to my backend that returns 200 + a timestamp + database connectivity check, so the monitor can verify more than just 'web server returns HTML'. Walk me through the dashboard step by step.",
+    what: "An external service that pings your site every minute or so. If it ever fails to respond, you get a text or email within minutes \u2014 even at 3am. Different from error monitoring, which only works when your app is up enough to phone home.",
+    why: "When your app is fully dead \u2014 server crashed, database unreachable, deployment broke \u2014 your error tracker can't tell you because it's also down or never sees the requests. The only thing that catches a total outage is something completely outside your stack pinging you from the outside. Most early-stage apps find out they're down from a customer complaint hours later.",
+    steps: [
+      "Sign up for UptimeRobot (free tier is fine for one site), Better Stack, or Pingdom.",
+      "Add monitors for: your homepage, your login page, and a /health endpoint on your backend.",
+      "Configure alerts to BOTH email and your phone (SMS or push) \u2014 pick whatever wakes you up.",
+      "Add a /health endpoint to your backend that does a quick database query and returns 200 only if everything works. Otherwise the monitor will say 'up' even when the database is dead.",
+      "Turn on the public status page (most providers include this free) and link to it from your footer or feedback widget \u2014 saves you from being flooded with 'is it down?' messages."
+    ],
+    redFlags: [
+      "You only know you're down when a user emails you",
+      "Monitoring is set to 'check every hour' (way too slow for a real launch)",
+      "Alerts go only to an email you check twice a day",
+      "/health endpoint just returns 200 without actually checking the database",
+      "No public status page \u2014 every outage = 100 'is it down?' messages"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "External uptime monitors live in a provider dashboard, not in the codebase. The scanner cannot prove the production URL is being checked from multiple regions or that alerts reach your phone."
+  },
+  {
+    id: "rate-limiting",
+    number: 21,
+    title: "Cap how often someone can hit your app",
+    category: "Security",
+    priority: "high",
+    timeEstimate: "1 hr",
+    prompt: "Act as a backend security engineer. Add rate limiting to every public-facing endpoint. Use a sensible default (60 req/min/IP) for read endpoints, and tighter limits for sensitive ones: login (5 per 15 min per IP+email), signup (3 per hour per IP), password reset (3 per hour per email), AI/expensive endpoints (whatever fits a daily budget \u2014 ask me what I'm willing to spend per day). Return a clean 429 response with a Retry-After header and a friendly JSON message. Log every rate-limit hit with IP and route so I can see attacks. Use my framework's recommended middleware (express-rate-limit, hono-rate-limit, etc.). Recommend in-memory vs Redis backing based on whether I'm running multiple instances. After you're done, give me a curl one-liner I can run to verify it actually blocks me after N attempts.",
+    what: "Rate limiting puts a maximum on how many requests one person (or one IP address) can make in a given window \u2014 say, 60 requests a minute. Without it, a single bot can hammer your backend until it falls over, run up your AI bill, or brute-force passwords until something works.",
+    why: "Without rate limits you are one bad actor away from a $10,000 OpenAI bill, a crashed server, or a leaked password. Rate limits are cheap to add and save you from a long list of nightmares.",
+    steps: [
+      "Add rate limiting to every public-facing endpoint.",
+      "Use stricter limits on the sensitive ones: login (5 per 15 minutes), signup (3 per hour), password reset (3 per hour), AI calls (whatever fits your budget).",
+      `Return a clear "you're going too fast, try again in X seconds" message \u2014 don't just silently fail.`,
+      "Watch for repeated rate-limit hits \u2014 they're usually attacks. Have alerts set up for spikes.",
+      'Ask your AI builder: "add per-IP rate limiting to all my endpoints with stricter limits on login, signup, and password reset."'
+    ],
+    redFlags: [
+      "No rate limits at all",
+      "Same limits everywhere (login should be way stricter than browsing)",
+      "Auth endpoints (login, signup, password reset) not strictly capped \u2014 brute-force and credential-stuffing bots will find you",
+      "No alerting when someone repeatedly hits the limit",
+      "You can't see how often this is happening"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "dependency-audit",
+    number: 22,
+    title: "Patch your dependencies for known vulnerabilities",
+    category: "Security",
+    priority: "high",
+    timeEstimate: "30 min",
+    prompt: "Act as a senior security engineer. Audit my project's installed dependencies for known vulnerabilities AND for supply-chain hygiene, and apply fixes. Tasks: (1) run the right auditor for my package manager \u2014 `npm audit` or `pnpm audit` for Node, `pip-audit` for Python, `bundle audit` for Ruby, `cargo audit` for Rust \u2014 and report the severity counts (critical / high / moderate / low). (2) for every Critical or High finding, try the auto-fix first (`npm audit fix`); if that doesn't clear it, upgrade the offending package manually and test the app after each change. Don't blindly `--force`. (3) if clearing a CVE needs a major-version bump that would break my app, document the CVE + the blocked upgrade + my exposure, then add a temporary mitigation if one's possible. (4) supply-chain hygiene \u2014 for every direct dependency, look up weekly download count and most-recent release date on the registry. Flag any dep with <1k weekly downloads (could be a typosquat \u2014 check the name against the obvious legitimate package) and any dep with no release in 12+ months (unmaintained \u2014 plan a replacement). (5) turn on automated dependency updates so this doesn't rot: Dependabot (free on GitHub) or Renovate \u2014 PR weekly for minor/patch, prompt on major. (6) add an audit step to my CI pipeline that fails the build on any new Critical CVE. When you're done, tell me plainly: any CVEs that made it to prod, any I deferred (with reasoning), any suspicious or abandoned deps I should swap, and the auto-update cadence you configured.",
+    what: "Your app pulls in hundreds of third-party packages via `npm install` (or pip, bundle, cargo). Some of those packages have known security bugs with public write-ups and working exploits. Auditing means running one command to list every known bug in your dependencies, then upgrading to the fixed versions.",
+    why: "Most successful attacks on small apps aren't clever \u2014 they're automated scanners finding sites that ship an old version of a popular library with a published CVE. The fix is usually a one-command upgrade. Skipping this is handing attackers the easiest version of your app.",
+    steps: [
+      "Run your package manager's audit command (`npm audit`, `pnpm audit`, `pip-audit`, `bundle audit`, `cargo audit`) and read the output.",
+      "For every Critical or High finding, try the auto-fix first (e.g. `npm audit fix`). Test that the app still works after each fix.",
+      "For fixes that require a major-version bump, read the package's upgrade notes before updating \u2014 breaking changes are real.",
+      "If a CVE has no fix yet, at least know you have it. Document it and subscribe to the package's security advisories.",
+      "Turn on Dependabot or Renovate in your GitHub repo so it opens PRs as new versions ship \u2014 you're not manually checking anymore.",
+      "Add the audit command to your CI pipeline so shipping a new Critical CVE breaks the build."
+    ],
+    redFlags: [
+      "You have never run `npm audit` (or your language's equivalent) on this project",
+      "The audit shows Critical severity \u2014 and you shipped anyway",
+      "Dependabot / Renovate is not turned on",
+      "Your lockfile hasn't been touched in more than 6 months",
+      "CI never fails on a new CVE \u2014 you'll only find out from a bug report or a breach"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Dependency risk changes daily and needs the package manager plus registry advisories at scan time. Static checklist data cannot prove every critical CVE has been patched or consciously deferred."
+  },
+  {
+    id: "logging",
+    number: 23,
+    title: "Keep a paper trail of what your app is doing",
+    category: "Operations",
+    priority: "high",
+    timeEstimate: "1 hr",
+    prompt: `Act as a senior backend engineer. Set up structured JSON logging across my app using my framework's recommended logger (pino, winston, etc.). Log: every login, signup, logout, password change, payment event, admin action, and every error with full context (user ID, request ID, route, sanitized params). NEVER log passwords, tokens, full credit card numbers, full session IDs, or any PII beyond what's strictly necessary \u2014 implement a redaction list. Add request ID middleware so every log line in a single request can be correlated. Set log levels: debug only in dev, info+ in production. Send logs somewhere I can search (Logtail, Axiom, Datadog, or my platform's log viewer). After you're done, write me a short "logging do/don't" reference card to paste into my README.`,
+    what: "Logging is your app writing down what it did, when, and for whom \u2014 like a security camera for code. When something goes wrong (a charge failed, an account got locked, data is missing), good logs let you reconstruct exactly what happened. Bad logs leave you guessing.",
+    why: "When you eventually have a weird bug or a user complaint that doesn't match what you see, logs are the difference between a 5-minute fix and a multi-day investigation. They're also your evidence if you ever have to prove what happened (security incident, billing dispute, abuse report).",
+    steps: [
+      "Use a structured logger (one that writes JSON, not raw text) \u2014 most frameworks have one built in.",
+      "Log every login, signup, password change, payment, and important user action.",
+      "Log every error with full context (which user, which endpoint, what they were doing).",
+      "NEVER log passwords, API keys, full credit card numbers, or any other secret. This is itself a security incident waiting to happen.",
+      "Keep logs for at least 30 days so you can investigate slow-burning issues."
+    ],
+    redFlags: [
+      "You're logging passwords or full personal info",
+      "Errors in production with no log trail at all",
+      "Logs are unstructured walls of text you can't search",
+      "Logs disappear within a day"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Logging is only launch-ready if the right events arrive in a searchable production sink without secrets. The scanner cannot prove retention, redaction, or dashboard access from code alone."
+  },
+  {
+    id: "session-management",
+    number: 24,
+    title: "Make sessions feel safe AND convenient",
+    category: "Security",
+    priority: "high",
+    timeEstimate: "1 hr",
+    prompt: `Act as a security engineer. Audit and improve my session management. Verify and fix: (1) sessions expire after 24h of inactivity; (2) password change invalidates ALL existing sessions for that user, not just the current one; (3) there's a "log out everywhere" button in account settings that actually works; (4) sessions are stored server-side (or as signed/encrypted JWTs with a short TTL plus refresh tokens) \u2014 never plaintext cookies; (5) session IDs rotate on login to prevent session fixation; (6) if I use JWTs, verify the verifier explicitly allowlists the signing algorithm (HS256 or RS256) and REJECTS tokens where alg is "none" or differs from what I signed with \u2014 algorithm-confusion attacks are a common JWT foot-gun. Verify the signing key is at least 256 bits of real randomness (not "secret" or "changeme") and comes from an env var, not a literal; (7) optional but recommended: show users a list of active sessions with device, IP, and last activity, with the ability to revoke any. Implement the changes, then explain each one in a plain-English sentence so I understand what changed and why.`,
+    what: "How you handle \u201Cis this person still logged in?\u201D over time. Get this right and users stay logged in long enough to be useful, but not so long that a forgotten laptop becomes a permanent risk.",
+    why: "Bad session handling is either annoying (kicked out every 20 minutes) or dangerous (still logged in three months later on a shared computer). The right defaults make both rare.",
+    steps: [
+      "Set sessions to expire after a reasonable window of inactivity (12\u201324 hours is normal).",
+      'Add a "Remember me" checkbox if you want longer sessions \u2014 but only when explicitly chosen by the user.',
+      "When a user changes their password, log out all their other sessions automatically.",
+      'Give users a "log out everywhere" button in their account settings.',
+      "If your auth provider supports it, show users where they're currently logged in (device, IP, last activity)."
+    ],
+    redFlags: [
+      "Sessions that never expire",
+      "Changing your password doesn't kick out other sessions",
+      "No way for a user to see or end their other sessions",
+      'Insecure "Remember me" (a long-lived plaintext token in a cookie)'
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "github",
+    number: 25,
+    title: "Connect to GitHub for backups and history",
+    category: "Infrastructure",
+    priority: "high",
+    timeEstimate: "30 min",
+    prompt: "Act as a developer-tooling expert. Walk me through connecting this project to a private GitHub repo step by step, in the simplest possible way for someone who has never used git from the command line. Then: (1) audit existing git history for any committed secrets and tell me which ones need to be rotated; (2) generate a complete .gitignore tuned to my exact stack (no .env, no build artifacts, no local DBs, no .DS_Store, no IDE folders); (3) verify nothing sensitive is currently being tracked; (4) set up a CODEOWNERS file with my GitHub username as default owner; (5) add a basic GitHub Actions workflow that runs my linter, typecheck, and tests on every push and PR. Explain each command in plain English BEFORE I run it.",
+    what: "GitHub is an external service that stores every version of your code, forever. Even if your project on your builder gets deleted, broken, or accidentally rolled back too far, GitHub has every version you ever pushed. It's also how anyone else (a co-founder, a contractor) collaborates with you.",
+    why: `Most builders have their own undo/checkpoint history, but having your code in a second place is one more disaster you'll never have. Plus: when you eventually want to hire a real developer, the first thing they'll ask is "can I have GitHub access?"`,
+    steps: [
+      "Create a free GitHub account if you don't have one.",
+      "In your builder, connect your project to a new GitHub repository \u2014 most have a one-click GitHub button in their Git or Version Control pane.",
+      "Make the repo private if your code includes business logic you don't want copied.",
+      "Confirm your secrets are NOT being pushed. Most builders exclude their secrets store by default, but double-check there's no .env file or hardcoded key leaking through. If anything sensitive made it in, rotate the keys at the source service immediately.",
+      "Push regularly \u2014 at least daily, ideally after every meaningful change."
+    ],
+    redFlags: [
+      "No version control at all (your only copy lives inside one builder)",
+      "Secrets accidentally pushed to the repo",
+      "You haven't pushed in days \u2014 you could lose work to one bad rollback",
+      "Public repo containing private business logic or customer data"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "rollback",
+    number: 26,
+    title: "Know how to roll back a bad deploy in under a minute",
+    category: "Operations",
+    priority: "high",
+    timeEstimate: "15 min",
+    prompt: "Act as a deployment engineer. For my specific hosting platform, walk me through the EXACT click-by-click procedure to roll back to the previous deploy. Then have me actually do it once \u2014 to a previous commit, then forward again \u2014 so I know the muscle memory before I need it. Also: (1) tell me what's preserved during a rollback (env variables, secrets, data) and what isn't (any DB migration that ran on the bad deploy is NOT undone \u2014 call this out); (2) recommend whether I should enable preview deployments on every PR/branch so I can test changes before they hit production; (3) give me a 5-line emergency runbook (ROLLBACK.md) I can paste into my repo: 'If production is broken, do these 3 things in this order.'",
+    what: "The ability to undo a deployment in 30 seconds and get back to the last known good version. Almost every modern host (Replit, Vercel, Netlify, Railway, Render, Fly) supports one-click rollback to any prior version \u2014 but you need to know where the button is BEFORE the bad deploy.",
+    why: "You will ship something broken to production. Your AI builder will help you 'fix' something at midnight and the fix will be worse. The difference between a 30-second outage and a 3-hour panic is whether you've practiced rolling back once when nothing was wrong.",
+    steps: [
+      "Find the Deployments or Releases panel in your hosting platform (most have 'Promote to production' or 'Rollback' next to each version).",
+      "Do a practice rollback NOW, while everything is fine. Roll back one version, confirm the site still works, then roll forward again. You want this in muscle memory.",
+      "Understand what rollback does NOT undo: any database migration that ran on the bad version is still applied \u2014 your code is rolled back but your schema isn't. Plan accordingly (migrations should be backwards compatible).",
+      "Turn on preview deployments (Vercel, Netlify, Railway all do this) so every change gets a temporary URL you can test before it touches production.",
+      "Write a 5-line ROLLBACK.md in your repo: '1. Open hosting dashboard. 2. Find latest known-good version. 3. Click Rollback. 4. Verify site works. 5. Tell users in status page / Twitter what happened.'"
+    ],
+    redFlags: [
+      "You don't know where the rollback button is in your hosting dashboard",
+      "You've never actually performed a rollback even once",
+      "All your changes go straight to production without a preview deployment",
+      "Database migrations run automatically and are not reversible",
+      "No written runbook \u2014 at 2am you'll be improvising in panic"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Rollback readiness is muscle memory in the hosting dashboard plus a real recovery path for data migrations. The scanner cannot prove you practiced rollback and forward again."
+  },
+  {
+    id: "soft-launch",
+    number: 27,
+    title: "Soft-launch to 5 friends before you launch publicly",
+    category: "Product & Launch",
+    priority: "high",
+    timeEstimate: "1 hr",
+    prompt: "Act as a product launch coach. Help me set up a soft launch to 5-10 friends/early users 48 hours before my public launch. Output: (1) a short personal outreach message I can DM each one \u2014 friendly, asks a specific favor, sets expectations; (2) a one-page 'try this' brief: signup flow \u2192 core feature \u2192 one specific thing to try; (3) a feedback capture template (Google Form or Typeform) with 5 sharp questions: what was confusing, what was broken, what would you tell a friend it does, would you actually use this and why, on a scale of 1-10 how likely to recommend; (4) a 'watch them use it' protocol if I can get 1-2 of them on a screen-share \u2014 what to watch for, what to NOT do (don't help, don't explain, don't apologize); (5) a triage rubric for sorting their feedback into 'must fix before public launch' vs 'next week' vs 'never'. Be ruthless about scope \u2014 this is 48 hours, not 4 weeks.",
+    what: "Send your app to 5-10 friends or early users 1-3 days before the public launch and watch what happens. Not for moral support \u2014 for finding the obvious things you've gone blind to from staring at it for two weeks.",
+    why: "This is the highest-leverage and cheapest item on the entire list. Five strangers will find five things you missed: the signup form that breaks on Safari, the button labeled 'Submit' that should be 'Save', the empty state that looks like a broken page. Catching these now costs an hour. Catching them on launch day in front of a thousand strangers costs your reputation.",
+    steps: [
+      "Make a list of 5-10 people who match your target user (not just supportive friends \u2014 actual matches). Include at least 2 who will be a little brutal.",
+      "Send each one a personal message (NOT a group blast) 48 hours before launch. Tell them what to try, what kind of feedback you want, how long it'll take, and that 'this is broken' is the most useful thing they can say.",
+      "If you can, get 1-2 on a screen-share. Watch silently. Don't help, don't explain, don't apologize. Where they hesitate is your bug list.",
+      "Collect feedback in one place (a Google Form or shared doc), not scattered DMs. Easier to spot patterns.",
+      "Sort the feedback into three buckets: must-fix-before-launch, do-in-week-1, never. Be ruthless \u2014 most public launches fail because the founder tried to fix everything in 48 hours and burned out."
+    ],
+    redFlags: [
+      "Going straight to public launch without anyone outside your head ever using it",
+      "Only sending to people you know will love it (selection bias = useless feedback)",
+      "Helping users when they get stuck instead of letting them struggle (you can't be there on launch day)",
+      "Trying to 'fix everything' from soft launch \u2014 you'll miss public launch and burn out",
+      "Feedback scattered across 10 DMs and a notebook \u2014 patterns are invisible"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "A soft launch is evidence from real humans, not a deploy artifact. The scanner cannot prove five target users tried the product and found the launch-day friction."
+  },
+  {
+    id: "interviews",
+    number: 28,
+    title: "Talk to your first 10 users on a real call",
+    category: "Growth",
+    priority: "high",
+    timeEstimate: "2 hr+",
+    prompt: `Act as a customer research expert in the style of Rob Fitzpatrick (The Mom Test). Help me prep for my first 10 user interview calls. Output: (1) a 15-minute interview script with 8-10 open-ended questions designed to surface real behavior and real pain \u2014 NOT to validate my product. Explicitly avoid leading questions like "don't you love\u2026?"; (2) an outreach email template I can personalize and send to early signups, offering a $20 gift card; (3) a calendar-friendly question set; (4) a one-page note-taking template that captures the user's actual words verbatim, not my interpretation; (5) a synthesis template I can use after 5+ interviews to spot patterns across calls. Before generating anything, ask me what my product does, who the users are, and what I'm trying to learn \u2014 so the script is sharp, not generic.`,
+    what: "A 15-minute video or phone call with each of your first early users. Not a survey. Not a Slack DM. An actual conversation where you mostly listen.",
+    why: "Data tells you what people do. Conversations tell you why. You'll find out which features confused them, which ones they actually use, and which problem they'd pay to solve. You can't guess your way to that.",
+    steps: [
+      "Reach out personally to your first 10\u201320 signups. Offer a $20 gift card if it helps (it does).",
+      "Schedule 15 minutes \u2014 keep it short so people actually show up.",
+      'Ask open questions: "Walk me through how you discovered us." "What were you trying to do when you signed up?" "What almost made you leave?"',
+      "Listen way more than you talk. Don't defend the product, don't pitch. Take notes.",
+      "After 5\u201310 calls, look for patterns. Those are your roadmap."
+    ],
+    redFlags: [
+      "You've never actually talked to a user out loud",
+      "You only talk to people who already love it (selection bias)",
+      `You ask leading questions ("don't you love that we did X?")`,
+      "You spend the call defending your decisions instead of listening",
+      "No notes \u2014 insights evaporate the moment the call ends"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Customer interviews are a research practice with real conversations and notes. The scanner can never tell whether ten users said the pain out loud in their own words."
+  },
+  {
+    id: "onboarding",
+    number: 29,
+    title: "Make the first 5 minutes obvious",
+    category: "Product & Launch",
+    priority: "high",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a senior product designer focused on first-run onboarding. Audit my app from the perspective of a brand-new user who has never seen it before. Create a fresh account and walk the first 5 minutes. Verify and fix: (1) the landing page tells me exactly what to do next; (2) signup does not ask for anything unnecessary before value; (3) the first logged-in screen has one obvious next action, not a dead empty state; (4) sample data, templates, or guided setup exist if the product is blank by default; (5) every permission, integration, or setup step explains why it is needed; (6) the user reaches a real 'aha' moment or useful artifact within 5 minutes. Output a friction log with timestamp, screen, what confused me, and the smallest fix. Then implement the top 3 fixes without redesigning the whole app.",
+    what: "The first 5 minutes are the difference between 'I get it' and 'I'll come back later' (they won't). A new user needs one clear path from landing page to signup to first value, even if their account starts with no data.",
+    why: "Vibe-coded apps often work only for the founder because the founder already knows what every blank page means. New users see an empty dashboard, a generic 'Get started' button, or a setup maze and assume the app is broken. You do not need fancy onboarding. You need the next action to be obvious.",
+    steps: [
+      "Create a brand-new account with an email that has never touched the app. Do not use your founder/admin account.",
+      "Start a timer and try to get to first value in 5 minutes: a saved result, a generated output, a created project, a shared link, whatever your app promises.",
+      "Make the first logged-in screen intentional. If there is no data yet, show an empty state with one clear action, not a blank dashboard.",
+      "Add sample data, templates, import prompts, or a 3-step setup checklist if the product needs context before it can be useful.",
+      "Watch one person do this without explanation. Where they pause, click randomly, or ask 'what now?' is the bug list."
+    ],
+    redFlags: [
+      "The first logged-in page is empty with no obvious next action",
+      "Users have to configure integrations before understanding the product",
+      "Signup asks for a long profile before the user sees value",
+      "Buttons say vague things like 'Continue' or 'Submit' when the action should be specific",
+      "You cannot explain what first value looks like in one sentence"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "First-run onboarding is a human walkthrough from fresh account to first value. The scanner cannot prove a brand-new user understands what to do in the first five minutes."
+  }
+];
+
+// ../../lib/checklist-data/src/items-medium.ts
+var ITEMS_MEDIUM = [
+  {
+    id: "analytics",
+    number: 30,
+    title: "Set up basic usage tracking",
+    category: "Operations",
+    priority: "medium",
+    timeEstimate: "1 hr",
+    prompt: "Act as a product analytics engineer. Install PostHog (or recommend Plausible / Fathom / GA4 if better for my case \u2014 explain why in 2 sentences). Wire automatic pageview tracking across my app. Then: (1) ask me to list 3-5 key user actions worth tracking (signup completed, feature X used, paid conversion, etc.); (2) instrument event tracking for each one with consistent naming (snake_case verbs); (3) set up identify() calls so events tie to specific users; (4) build me a starter dashboard showing weekly signups, activations, and a funnel from landing \u2192 signup \u2192 first key action; (5) confirm tracking respects Do-Not-Track and works with my cookie banner if I have one. List every env var I need to set.",
+    what: "Analytics is software that records what users actually do in your app \u2014 which pages they visit, which buttons they click, where they drop off. Without it you're flying blind about what's working.",
+    why: "Your gut about what users do is almost always wrong. Analytics replaces guessing with evidence \u2014 so when you decide what to fix or build next, you're using data instead of your favorite theory.",
+    steps: [
+      "Pick one tool. PostHog is free and great for product analytics. Plausible or Fathom for simple, privacy-friendly traffic stats. Google Analytics if you want the giant ecosystem.",
+      "Install it on every page (one snippet \u2014 your AI builder can do this).",
+      "Decide your 3\u20135 metrics that actually matter (signups, activations, paid conversions, daily actives \u2014 pick yours).",
+      "Set up event tracking for each one and verify the events show up in the dashboard.",
+      "Make a habit of looking at the dashboard daily for the first month."
+    ],
+    redFlags: [
+      "No analytics installed at all",
+      "Analytics installed but you've never looked at it",
+      "You're tracking everything except the things that matter",
+      'No clear definition of "a successful week" in numbers'
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Analytics has to be verified inside the live analytics dashboard with real events. The scanner cannot prove pageviews, key actions, consent behavior, or reporting are actually arriving."
+  },
+  {
+    id: "db-performance",
+    number: 31,
+    title: "Make your database queries fast",
+    category: "Infrastructure",
+    priority: "medium",
+    timeEstimate: "2 hr+",
+    prompt: `Act as a senior database engineer. Audit my database schema and ORM queries for performance. Specifically: (1) list every column I filter, sort, join, or group by, and tell me which ones are missing indexes \u2014 recommend the right index type (B-tree, partial, composite); (2) find every N+1 query pattern (loading a list and then making one query per item) and refactor to joins, eager loading, or batched queries; (3) find any query that fetches all rows when it should paginate; (4) find unnecessary SELECT * \u2014 replace with explicit columns; (5) verify connection pooling is configured correctly for my deployment topology. Output a before/after summary per fix with an estimated impact (e.g., "200 queries \u2192 1 query per page load"). Generate the migration files for new indexes. Don't run them \u2014 let me review first.`,
+    what: "Your database stores all your data, and your app constantly asks it questions (\u201Cgive me this user's posts\u201D). Without basic tuning, those questions get slower as data grows \u2014 until pages take 5 seconds to load, you exhaust your database connection limit, or your hosting bill explodes.",
+    why: "Slow apps lose users. Each one-second delay roughly halves the chance someone will wait. And it's almost never a hardware problem \u2014 it's usually a missing index on a table, or the same query running 200 times when it could run once.",
+    steps: [
+      'Add an index on any column you search or filter by often (user_id, email, created_at). your AI builder can identify candidates: "audit my schema and suggest indexes based on how I query each table."',
+      "Make sure you're using connection pooling \u2014 most ORMs have it on by default, but verify.",
+      'Watch for the "N+1 query" pattern (loading a list, then making one extra query per item). Refactor those into a single join.',
+      "Cache expensive read queries that don't change often (e.g., a leaderboard that updates hourly).",
+      "Turn on slow query logging and check it weekly. Anything over 500ms deserves a look."
+    ],
+    redFlags: [
+      "Pages that take 2+ seconds to load even when there's only a little data",
+      "A single page view triggers hundreds of database queries",
+      "Database CPU pegged at 100% under light load",
+      "You have no idea which queries are your slowest"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Database performance depends on real query plans, row counts, indexes, and connection pooling under production-like load. The scanner cannot prove the app stays fast as data grows."
+  },
+  {
+    id: "custom-domain",
+    number: 32,
+    title: "Get your own domain (yourname.com)",
+    category: "Infrastructure",
+    priority: "medium",
+    timeEstimate: "30 min",
+    prompt: "Act as an infrastructure engineer. Walk me through pointing a custom domain at my deployed app, end to end. First, ask me: my domain registrar (Namecheap, Cloudflare, etc.), my hosting/builder, and my domain (e.g. example.com). Then output: (1) the exact DNS records I need to add (type, name, value, TTL); (2) where to add them in my registrar's UI, click by click; (3) how long propagation typically takes; (4) how to set up www \u2192 root redirect (or root \u2192 www \u2014 ask my preference); (5) how to verify the lock icon and HTTPS are working; (6) how to add HSTS once I'm confident the site is stable. Use plain English \u2014 assume I have no DNS knowledge.",
+    what: "Right now your app probably lives at some auto-generated URL on your builder's domain (e.g. something.replit.app, my-app.lovable.app, project.vercel.app). A custom domain (yourname.com) makes you look like a real product, not a weekend project, and gives you the freedom to switch hosting providers later without changing your URL.",
+    why: "First impressions matter more than they should. People trust their-startup.com way more than their-startup-prod-v2.some-builder.app. It also makes your URL memorable and tweetable.",
+    steps: [
+      "Buy a domain from Namecheap, Porkbun, or Cloudflare Registrar \u2014 they all sell at near-cost. Avoid GoDaddy.",
+      "In your builder's deployment or hosting settings, add your custom domain. It will show you exactly which DNS records to add at your registrar.",
+      "Add those DNS records at your registrar. Wait a few minutes (sometimes hours) for the change to spread across the internet.",
+      "By default the site lives at example.com. If you want www.example.com to also work, the cleanest way is to put your domain behind Cloudflare and set up a www \u2192 root redirect rule (link below).",
+      "Once it's live, confirm the lock icon appears (HTTPS is automatic on most modern hosting) and that http:// redirects to https://."
+    ],
+    redFlags: [
+      "Still using the default builder-supplied subdomain (.replit.app, .lovable.app, .vercel.app, etc.) in production",
+      "Lock icon missing (SSL not provisioned yet)",
+      "Both www and non-www serve duplicate content with no clear primary",
+      "DNS pointing somewhere stale (an old hosting provider, a dead service)"
+    ],
+    references: [
+      {
+        label: "Redirect www to root (Cloudflare)",
+        url: "https://developers.cloudflare.com/rules/url-forwarding/single-redirects/examples/redirect-www-to-root/"
+      }
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Custom-domain readiness depends on live DNS, hosting settings, redirects, and issued certificates. The scanner cannot prove the exact production domain is pointed correctly without owner DNS verification."
+  },
+  {
+    id: "email",
+    number: 33,
+    title: "Make app emails actually arrive",
+    category: "Infrastructure",
+    priority: "medium",
+    timeEstimate: "1 hr",
+    prompt: "Act as a backend engineer. Set up production-grade transactional email. Default to Resend unless you have a strong reason to recommend Postmark/SendGrid \u2014 explain. Tasks: (1) install the SDK and replace any nodemailer / raw SMTP / personal-Gmail code; (2) generate the SPF, DKIM, and DMARC DNS records I need to add for my sending domain (ask me what domain to use); (3) build clean, on-brand templates for welcome, password reset, email verification, and any other transactional events my app needs; (4) add a /unsubscribe handler for any non-transactional emails; (5) add proper error handling \u2014 log delivery failures and retry transient ones; (6) test by sending each flow to my own inbox. Show me how to verify deliverability with mail-tester.com and what score to aim for.",
+    what: "When your app sends emails (welcome, password reset, receipts, invites), they need to land in real inboxes from a real sending domain. A dedicated email service plus SPF, DKIM, and DMARC is what keeps your app from looking broken when the code technically sent the message.",
+    why: "Email bugs feel like product bugs to users. If password reset, login code, receipt, or invite emails land in spam, people do not think 'deliverability issue' \u2014 they think your app does not work. This is also where paid users get locked out and refund requests start.",
+    steps: [
+      "Pick a provider: Resend (modern, dev-friendly, generous free tier) or Postmark (excellent deliverability) for transactional. SendGrid if you need bulk.",
+      "Create an account and verify your sending domain. Add SPF, DKIM, and DMARC DNS records, then wait until the provider marks them verified.",
+      `Replace anywhere in your code that sends email to use the provider's SDK. Ask your AI builder: "switch all my outgoing email to use Resend."`,
+      "Build clean templates for: welcome, password reset, key transactional events. Keep them simple and on-brand.",
+      "Test every critical flow by sending to your own Gmail, iCloud, and Outlook/Hotmail addresses if you can: signup, password reset, login code, invite, receipt, and support reply.",
+      "Run one message through mail-tester.com or a similar deliverability checker and fix anything obvious before launch."
+    ],
+    redFlags: [
+      "App emails coming from your personal Gmail",
+      "Test emails landing in spam",
+      "No SPF / DKIM / DMARC configured for your domain",
+      "Password reset, OTP, invite, or receipt emails have never been tested in a real inbox",
+      "No way to see when emails fail to send"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Email deliverability lives in provider dashboards and real inboxes. The scanner cannot prove SPF, DKIM, DMARC, templates, retries, or inbox placement without a delivered test email."
+  },
+  {
+    id: "mobile",
+    number: 34,
+    title: "Make it not suck on phones",
+    category: "Product & Launch",
+    priority: "medium",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a senior mobile-first frontend engineer. Audit my app at 375px wide (iPhone SE) and 414px wide (iPhone Pro). For every page, find and fix: (1) any horizontal scroll; (2) any tap target smaller than 44x44px; (3) any text smaller than 16px; (4) any input where the on-screen keyboard would cover the field being typed into; (5) any layout that breaks (overlapping, clipped, unreadable). Also walk through my most important flows (signup, the core feature, checkout) end-to-end on mobile and report any friction. List every issue with file/component, then fix them. Don't make desktop worse \u2014 use responsive breakpoints, not mobile-only overrides. After fixes, list every URL I should manually re-test on a real phone before launch.",
+    what: "Most of your users will open your site on their phone first. If buttons are too small to tap, text needs zooming, or the layout breaks sideways, they leave and never come back.",
+    why: "Over half of all web traffic is mobile. If your app is desktop-only by accident, you're losing more than half your potential users before they even see your value.",
+    steps: [
+      "Open your app on your actual phone, not just the desktop browser shrunk down. The two are different.",
+      "Make sure body text is at least 16px so people don't have to zoom.",
+      "Buttons and tappable links should be at least 44 by 44 pixels \u2014 finger-sized, not cursor-sized.",
+      "Test the most-used flows (signup, the one feature people came for, checkout) all the way through on a phone.",
+      "No horizontal scrolling. Ever. Fix any element that overflows the screen."
+    ],
+    redFlags: [
+      "Buttons you can't reliably tap with a thumb",
+      "Tiny text that makes you pinch to zoom",
+      "Pages that scroll sideways",
+      "Forms where the keyboard covers the input you're typing into",
+      "You've only tested in the desktop browser at full width"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Mobile readiness is a real-device walkthrough problem. Static signals cannot prove tap targets, keyboard behavior, checkout friction, or awkward responsive states on actual phones."
+  },
+  {
+    id: "performance",
+    number: 35,
+    title: "Make it fast",
+    category: "Product & Launch",
+    priority: "medium",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a web performance engineer. Audit my app for Core Web Vitals (LCP, INP, CLS) and overall load time. Find and fix: (1) oversized images (anything over 200KB unless absolutely necessary) \u2014 convert to webp/avif and add proper width/height attributes; (2) any blocking JavaScript or CSS in <head>; (3) any third-party script that isn't async/defer; (4) any heavy component above the fold that could be lazy-loaded; (5) missing cache-control headers on static assets; (6) any client-side fetch waterfall that could be a single batched request. After fixes, tell me the realistic mobile pagespeed.web.dev score I should expect. If my framework supports it, set up automatic image optimization and route-level code splitting.",
+    what: "How quickly your pages load and respond. Fast feels professional and confident; slow feels broken and amateur \u2014 even if everything technically works.",
+    why: "People bail on slow pages, and they bail fast \u2014 most users give up on a site that takes longer than three seconds. Fast sites also rank better in search.",
+    steps: [
+      "Compress and resize images before uploading. Use modern formats (webp, avif). Don't serve a 5MB photo when 200KB looks identical.",
+      "Set up caching headers on static stuff (images, fonts, CSS) so returning visitors don't re-download everything.",
+      "Run your homepage through https://pagespeed.web.dev \u2014 aim for 90+ on mobile.",
+      "Avoid loading huge JavaScript bundles. If you're using a framework, lazy-load anything that isn't needed for the first paint.",
+      "Use a CDN (Cloudflare's free tier works great) so people far from your server still get fast loads."
+    ],
+    redFlags: [
+      "Initial page load over 3 seconds on a fast connection",
+      "Huge unoptimized images on the homepage",
+      "PageSpeed score under 70 on mobile",
+      "No caching headers \u2014 every visit re-downloads everything"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Performance depends on live assets, hosting cache headers, network waterfalls, and Core Web Vitals. The scanner cannot prove real mobile load speed from checklist content alone."
+  },
+  {
+    id: "accessibility",
+    number: 36,
+    title: "Make it usable for everyone, including people with disabilities",
+    category: "Product & Launch",
+    priority: "medium",
+    timeEstimate: "2 hr+",
+    prompt: 'Act as a senior accessibility engineer. Audit my app against WCAG 2.1 AA. For every page: (1) check color contrast (4.5:1 for normal text, 3:1 for large text and UI components); (2) verify all interactive elements are reachable and operable by keyboard alone (Tab, Shift+Tab, Enter, Space, arrow keys where appropriate); (3) verify proper semantic HTML \u2014 actual <button>, <nav>, <main>, <h1>-<h6>, not <div onClick>; (4) verify every meaningful image has alt text and decorative ones use alt=""; (5) verify form inputs have associated <label> elements and aria-describedby for help/errors; (6) verify focus states are visible and not removed by CSS; (7) verify color is never the only indicator of meaning. Output a prioritized fix list, then apply the fixes. Run axe-core (or your equivalent) at the end and show me the clean report.',
+    what: "Accessibility means making sure your app works for people who use screen readers, navigate with a keyboard instead of a mouse, have low vision, or can't see colors well. It also accidentally makes the app better for everyone \u2014 clearer, more readable, more navigable.",
+    why: "It's the right thing to do. It expands who can use your product. And in many places (US, EU, UK) it's legally required \u2014 there are real lawsuits.",
+    steps: [
+      "Use real semantic HTML \u2014 actual <button>, <nav>, <a> tags, not divs with click handlers.",
+      "Make sure text has enough contrast against its background. The WebAIM contrast checker is free.",
+      "Test that you can navigate the entire app with only the Tab key \u2014 every interactive thing should be reachable.",
+      'Add alt text to every meaningful image. Decorative images get alt="".',
+      "Run an accessibility checker (axe DevTools, Lighthouse) on each page and fix what it finds."
+    ],
+    redFlags: [
+      "Light gray text on white backgrounds (or any low-contrast combo)",
+      "You can't Tab through the app",
+      "Form inputs with no labels",
+      "Images that carry meaning but have no alt text",
+      "Color is the ONLY way you signal something (e.g., red = error with no other indicator)"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Accessibility needs keyboard and assistive-tech verification across real pages. Static code checks miss focus order, contrast in rendered states, and whether the flow is actually usable."
+  },
+  {
+    id: "seo",
+    number: 37,
+    title: "Set up the basics so search and social shares work",
+    category: "Growth",
+    priority: "medium",
+    timeEstimate: "1 hr",
+    prompt: "Act as a technical SEO engineer. Add complete meta tags to every page. For each route, generate a unique <title> (\u226460 chars, includes brand) and meta description (\u2264160 chars, action-oriented and not stuffed with keywords). Add full Open Graph tags (og:title, og:description, og:image with absolute URL, og:url, og:type, og:site_name) and Twitter Card tags (summary_large_image variant with the same image). Add a canonical link per page. If my framework supports it (Next, Remix, Nuxt, SvelteKit, etc.), use the framework's metadata API; otherwise inject into <head>. Generate /sitemap.xml and /robots.txt using the real production domain (ask me what it is). When done, give me 3 URLs from my site I can paste into opengraph.xyz to verify previews look right.",
+    what: "Tiny bits of metadata in your HTML that tell Google what each page is about, and tell Twitter, LinkedIn, Slack, and iMessage how to display a preview when someone shares your link.",
+    why: "These are your free billboards. A page with no title gets no clicks in Google. A link in iMessage with no preview image looks broken or sketchy. You only have to do this once per page.",
+    steps: [
+      "Give every page a unique <title> (under 60 characters) that describes the page and includes your brand.",
+      "Add a unique meta description (under 160 characters) \u2014 this is what shows under your link in Google.",
+      "Add Open Graph tags (og:title, og:description, og:image, og:url) \u2014 these power link previews in iMessage, Slack, LinkedIn.",
+      "Add Twitter Card tags (twitter:card = summary_large_image plus title/description/image) for Twitter/X previews.",
+      "Test how your link looks BEFORE you announce it: opengraph.xyz, metatags.io, or just paste it into a Slack channel and see."
+    ],
+    redFlags: [
+      "Every page has the same generic title",
+      "No meta descriptions (Google generates random snippets for you)",
+      "Sharing your link shows no preview image",
+      "Preview image is broken or shows a default builder-supplied placeholder",
+      "No canonical URL set (causes duplicate-content issues in search)"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "feedback",
+    number: 38,
+    title: "Give users an easy way to tell you what's broken",
+    category: "Product & Launch",
+    priority: "medium",
+    timeEstimate: "1 hr",
+    prompt: 'Act as a product engineer. Add an in-app feedback widget. Requirements: (1) a small persistent button \u2014 floating bottom-right, or a "Feedback" link in the footer/settings menu; (2) the form has 3 fields: "What were you trying to do?", "What happened?", "What did you expect?" plus an optional email and an optional screenshot upload; (3) submissions go to my email via Resend AND get stored somewhere searchable (a database table or a service like Linear/Plain/Crisp); (4) automatically attach context: current URL, browser, viewport size, user ID if logged in, recent error from console if any; (5) thank-you state after submission with a friendly message and a "we read every one" line; (6) fully accessible \u2014 keyboard navigable, escape to close, focus trapped while open. Test the full flow before declaring it done.',
+    what: "A button somewhere obvious in your app that says \u201CFeedback\u201D or \u201CReport a bug\u201D and opens a simple form. Without it, people who hit problems just leave silently.",
+    why: "Your first 100 users see things you'll never see. They use the app on devices you don't own, with workflows you didn't imagine, and they hit bugs you can't reproduce. You need a low-friction way for them to tell you \u2014 and you need to actually read every one.",
+    steps: [
+      'Add a "Feedback" or "Report issue" button somewhere persistent (footer, settings menu, floating button).',
+      "Open a simple form: a free-text box, an optional email, an optional screenshot. That's it.",
+      "Ask three things: what were you trying to do, what happened, what did you expect?",
+      "Pipe submissions somewhere you actually check (your inbox, a Slack channel) \u2014 not a database table no one looks at.",
+      "Promise yourself a 24-hour response window during launch week. Reply to everyone, even the angry ones."
+    ],
+    redFlags: [
+      "No way to contact you from inside the app",
+      "Feedback form goes to an inbox no one reads",
+      "You only respond to praise, not complaints",
+      "Bug reports vanish without acknowledgment",
+      "You have no system for turning reports into a real fix list"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "A feedback widget only counts if a real report reaches the place you actually watch. The scanner cannot prove submissions, screenshots, context capture, and response workflow end-to-end."
+  },
+  {
+    id: "responsive-actions",
+    number: 39,
+    title: "Make every action tell the user what's happening",
+    category: "Product & Launch",
+    priority: "medium",
+    timeEstimate: "2 hr+",
+    prompt: "Act as a senior frontend engineer auditing user-facing async UX. Walk every place a user kicks off something that talks to my server \u2014 clicking a button, submitting a form, uploading a file, paying. For each one verify: (1) a visible loading state appears within ~100ms \u2014 spinner, progress bar, inline 'Saving\u2026', not silence; (2) the trigger control disables (or visibly changes) while the request is in flight, and re-enables on success OR error so a failed click is retryable; (3) success and error states are explicit \u2014 no 'click and pray'; (4) for any write that creates data the user paid for or cares about (orders, payments, reservations, sends, AI generations they paid tokens for), the server enforces idempotency \u2014 the same request twice never creates two records (idempotency keys, server-side dedup by client-generated UUID, or a database unique constraint, whichever fits the route). Also audit empty states: a brand-new user with no data should see an intentional empty page, not a blank one that looks broken. For each finding output: file/component, what's missing, exact fix. Apply the fixes. Don't make spinners janky \u2014 keep them subtle, on-brand, and never jumpy.",
+    what: "Every time a user clicks a button that talks to the server, three things have to be true: they SEE that something is happening, they CAN'T accidentally fire it twice, and the request is safe to receive twice on the backend anyway. Vibe-coded apps default to silence-then-success \u2014 and that's how you ship duplicate orders, double charges, and refresh-mid-submit chaos.",
+    why: "This one isn't dramatic until it is. The user clicks Submit, sees nothing for a beat, decides the page is broken, hits refresh \u2014 and now your app has either lost their input, charged them twice, or sent the same email twenty times. Loading state + disabled-while-submitting + server-side idempotency are the three legs of the stool. Two out of three is not safe. Do this on day one, not day thirty.",
+    steps: [
+      "On every button or form that fires a network request, show a loading state within ~100ms \u2014 a spinner, an inline 'Saving\u2026', or a skeleton. Silence is a bug.",
+      "Disable the trigger while the request is in flight, and re-enable on success OR error. Buttons that stay dead after an error force the user to refresh \u2014 and that's where you lose data.",
+      "For any write the user would mind being duplicated (order, payment, reservation, message sent, AI generation), enforce idempotency on the server \u2014 a client-generated idempotency key in the request, a unique database constraint, or a server-side dedup window. Disabling the button alone is not enough; a slow phone, a flaky network, or an aggressive double-tap will get past it.",
+      "Test the failure mode on purpose. In your browser dev tools, throttle the network to 'Slow 3G' and double-click Submit before it finishes. If you end up with two records, your idempotency is missing.",
+      "Empty states get the same energy. A brand-new user with no data should see a designed empty page with a clear next action \u2014 not a blank screen that looks like the load failed."
+    ],
+    redFlags: [
+      "You can double-click any submit button and create two records",
+      "Spinners that show up after a 1-second delay (or never)",
+      "Buttons that stay disabled forever after an error \u2014 user has to refresh to retry",
+      "Payments, orders, or other 'really would hate to do this twice' actions with no idempotency on the server",
+      "Empty pages that look identical to a broken page \u2014 a brand-new user can't tell if it loaded"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Responsive actions need hands-on flow testing with slow networks and double-clicks. The scanner cannot prove every important mutation shows loading, recovers from errors, and is idempotent."
+  },
+  {
+    id: "launch-polish",
+    number: 40,
+    title: "Walk through the whole app one last time",
+    category: "Product & Launch",
+    priority: "medium",
+    timeEstimate: "2 hr+",
+    prompt: `Act as a senior product designer doing a launch readiness review. Do a thorough end-to-end pass through my app and find every rough edge. Specifically: (1) every loading state \u2014 does it look intentional or like the page is broken? (2) every empty state \u2014 is it designed, with helpful copy and a clear next action? (3) every error state \u2014 is the message human and actionable, not "Error: undefined"? (4) every form \u2014 does it validate inline and tell users exactly what went wrong? (5) every link \u2014 does it actually go somewhere live? (6) visit a URL that doesn't exist (yourdomain.com/this-page-isnt-real) \u2014 is there a real 404 page that gets people back home, or do they land on a white screen / the platform's default error page? (7) every piece of copy \u2014 does it sound like a person wrote it? Cut AI tells like "unleash", "leverage", "in today's fast-paced world", "seamlessly", "harness the power of". Output a prioritized fix list by severity, then apply the fixes. Don't rewrite working code \u2014 only touch what's actually wrong.`,
+    what: "A nitpicky end-to-end pass through your own product, looking for the small ugly stuff: typos, broken links, awkward loading states, white-screen 404s on URLs that don't exist, blank pages where data hasn't loaded yet, copy that sounds like an AI wrote it.",
+    why: "This is where good products separate from great ones. Users don't consciously notice polish, but they feel it as \u201Cthis feels solid\u201D or \u201Cthis feels janky.\u201D",
+    steps: [
+      "Click every link, every button, every menu item. Note anything that goes nowhere or breaks.",
+      "Visit a URL that doesn't exist on purpose (yourdomain.com/not-a-real-page). If you get a white screen or your hosting provider's default error page, build a real 404 \u2014 a page that says 'we couldn't find that' and links back home in one tap. Broken links, mistyped URLs, and old social shares all land here, and white screens send away visitors who took months to acquire.",
+      "Refresh on a slow connection (browser dev tools can simulate one) \u2014 make sure loading states look intentional, not broken.",
+      "Look at empty states (a brand-new account with no data) \u2014 design these on purpose, don't leave them blank.",
+      `Read every piece of copy out loud. Cut every sentence you can. Replace AI tells ("Unleash the power of...", "In today's fast-paced world...") with how a real person actually talks.`,
+      "Have one friend complete a key flow (signup \u2192 first action) without your help. Watch where they hesitate. That's your homework."
+    ],
+    redFlags: [
+      "Broken links anywhere",
+      "Visiting a non-existent URL shows a white screen or the platform's default error page (no real 404)",
+      "Typos in user-facing text",
+      "Loading states that look like errors",
+      "Empty states that look broken or unfinished",
+      "Copy that sounds like a chatbot wrote it"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "launch-list",
+    number: 41,
+    title: "Map exactly where your first 100 users will come from",
+    category: "Growth",
+    priority: "medium",
+    timeEstimate: "1 hr",
+    prompt: "Act as a no-BS growth strategist for early-stage products. Help me build a concrete, named launch distribution plan for getting my first 100 users \u2014 not 'do social media' generic advice. First, ask me what my product is and who it's for. Then output a one-page plan: (1) the 5-10 specific subreddits where my target user actually hangs out, with each subreddit's posting rules (no spam, founder-friendly, requires X karma, etc.) and the EXACT post angle that fits each one; (2) 3-5 niche communities (Discord servers, Slack groups, Indie Hackers, specific newsletters' comment sections); (3) 10-20 named individuals (Twitter/X, LinkedIn) who would plausibly share this if I sent a thoughtful DM, with a script for what to send each; (4) the right launch surface for me \u2014 Product Hunt yes/no with reasoning, Hacker News yes/no with reasoning, BetaList, Indie Hackers; (5) what to NOT do (cold mass-DM blast, generic LinkedIn post, paid ads on day one). Be specific to MY product \u2014 refuse to give generic advice.",
+    what: "A written list, BEFORE launch day, of the exact 30-50 places, communities, and people you'll tell about your app \u2014 and what you'll say in each one. Not 'post on social media.' Specific subreddits with their rules, specific Discord servers, specific people whose DMs you'll personally write.",
+    why: "Every failed indie launch went the same way: 'I posted it on Twitter and Product Hunt and got 14 visitors.' Distribution doesn't happen because you launched \u2014 it happens because you spent the week before launch deciding exactly who to tell and what to say to each. Doing this work after launch is too late; you'll be busy answering bug reports.",
+    steps: [
+      "Make a literal list. Spreadsheet, doc, anything. Columns: where, who runs it, their rules, my angle for THIS audience, when I'll post.",
+      "For each spot, lurk first. Read the last week of posts. Match their tone. Communities can smell drive-by spam in one sentence.",
+      "Tailor the message \u2014 same product, different pitch for each audience. Indie Hackers wants the founder story; r/your-niche wants 'here's a tool I made for our problem.'",
+      "Identify 10-20 named humans whose audience overlaps yours. Write each one a real, personal DM the day of launch \u2014 not a copy-paste blast.",
+      "Decide if you're doing Product Hunt / Hacker News and prep accordingly. Both reward founders who showed up early in their communities; they punish drive-bys."
+    ],
+    redFlags: [
+      "Your launch plan is 'I'll post on Twitter and Product Hunt'",
+      "You haven't lurked in the communities you plan to post in",
+      "Same generic copy posted everywhere",
+      "Mass cold DM / mass cold email blast (kills your reputation faster than any bug)",
+      "No named list \u2014 only 'social media' and 'communities' as vague buckets"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Distribution planning is a founder artifact: named communities, real rules, and outreach angles. The scanner cannot prove your first-100-user list exists or is credible."
+  },
+  {
+    id: "support",
+    number: 42,
+    title: "Give users a real way to get help",
+    category: "Product & Launch",
+    priority: "medium",
+    timeEstimate: "1 hr",
+    prompt: "Act as a customer support systems designer for a tiny early-stage app. Add a simple, real support path that a paying or stuck user can find in under 10 seconds. Requirements: (1) a support email or help link visible from footer, account/settings, checkout/success, receipts, and error states; (2) route support messages somewhere I actually monitor daily; (3) include enough context automatically when possible: user ID, email, current URL, order/report ID, browser, and last error; (4) create canned first replies for payment issue, login/code not arriving, data deletion/export, bug report, and refund request; (5) add a simple SUPPORT.md with where messages land, expected response time during launch week, and refund/escalation rules. Do not add a giant help center. Make the smallest support loop that prevents paying users from feeling abandoned.",
+    what: "Feedback is how users tell you what is broken. Support is how a real person gets help when they are stuck, locked out, charged, confused, or angry. For a vibe-coded launch, this can be one monitored email address \u2014 but it has to be visible and it has to work.",
+    why: "The worst early customer experience is not a bug. It is paying, getting stuck, and finding no human way out. A simple support path turns panic into a conversation and keeps small launch issues from becoming public complaints.",
+    steps: [
+      "Create one support destination you will actually watch during launch week: support@yourdomain.com, a shared inbox, Plain, Crisp, Intercom, HelpScout, or even a monitored Gmail alias.",
+      "Put the support link where pain happens: footer, account/settings, checkout success, receipt email, error pages, login/OTP screens, and paid-report pages.",
+      "When support is opened from inside the app, include context automatically if you can: current URL, user ID, email, order/report ID, browser, and the last visible error.",
+      "Write canned first replies for the obvious launch-week cases: payment did not unlock, login code missing, refund request, bug report, account deletion/export, and 'what is this charge?'",
+      "Commit to a launch-week response window you can actually meet, then write it down where future-you will see it."
+    ],
+    redFlags: [
+      "No support link anywhere inside the app",
+      "Support goes to an inbox no one checks",
+      "Receipt, checkout success, and error screens give users no way to contact you",
+      "No plan for payment/access issues after someone pays",
+      "Support messages arrive with no context, forcing users to re-explain everything"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Support readiness is only real if a message reaches the inbox or tool the owner watches and includes enough context to resolve it. The scanner cannot prove someone will see and answer the request."
+  }
+];
+
+// ../../lib/checklist-data/src/items-lower.ts
+var ITEMS_LOWER = [
+  {
+    id: "aeo",
+    number: 43,
+    title: "Make AI assistants able to recommend you",
+    category: "Growth",
+    priority: "lower",
+    timeEstimate: "2 hr+",
+    prompt: "Act as an AEO (answer engine optimization) specialist. Make my site quotable by AI engines (ChatGPT, Perplexity, Google AI Overviews, Claude). Tasks: (1) generate JSON-LD structured data for my homepage (Organization, WebSite) and key pages (Product, FAQPage, Article where applicable) and embed it in <head>; (2) create a real /faq page covering the 10-20 questions a real prospect asks before buying \u2014 ask me what my product is so the questions are accurate. Each answer 40-60 words, direct answer first, then context; (3) restructure my main marketing pages so each section starts with a 1-2 sentence summary BEFORE the long explanation (AI engines grab the top); (4) make sure no SEO-important content is gated behind a login or only rendered client-side; (5) add an /llms.txt at the root summarizing my site for AI crawlers. Test the result with Google's Rich Results Test and report what each page is eligible for.",
+    what: "More and more people ask ChatGPT, Perplexity, or Google's AI Overviews instead of clicking through search results. Those AIs are pulling answers from websites \u2014 but only the ones structured in a way they can confidently quote. AEO is the work of making your site quotable.",
+    why: `Search is shifting from "here are 10 links" to "here's the answer." If your content isn't structured for AI engines to extract, you're invisible to a fast-growing channel \u2014 even if your normal SEO is fine.`,
+    steps: [
+      "Add a real FAQ page covering the top 10\u201320 questions people actually ask about your product. Keep answers tight (40\u201360 words each).",
+      'Write headings as full questions ("How do I cancel my subscription?" instead of "Cancellation").',
+      "Add structured data (JSON-LD) to your pages: at minimum FAQPage schema on the FAQ page and Organization schema on your homepage. your AI builder can generate these.",
+      "Lead each content section with a 1\u20132 sentence direct answer at the top, before the long-form explanation. AIs grab the top.",
+      "Make sure important content isn't locked behind login or only rendered by JavaScript \u2014 AI crawlers often miss those.",
+      "Add an /llms.txt file at your site root. It's the AI-crawler equivalent of robots.txt: a short plain-text summary of what your site is, who it's for, and links to your sitemap and FAQ. ChatGPT, Perplexity, and Claude all read it.",
+      "Test your structured data with Google's Rich Results Test \u2014 it tells you what AIs can actually see."
+    ],
+    redFlags: [
+      "No structured data anywhere on your site",
+      "Long-winded content with no short summary at the top",
+      "Important content gated behind a login wall",
+      "No FAQ section answering the questions people actually ask",
+      "Headings that are vague labels instead of clear questions",
+      "No /llms.txt at your root \u2014 AI crawlers have nothing to anchor on",
+      "Content that targets keyword strings instead of full questions people actually ask"
+    ],
+    cliCoverage: "automated"
+  },
+  {
+    id: "community",
+    number: 44,
+    title: "Start a small community space",
+    category: "Growth",
+    priority: "lower",
+    timeEstimate: "1 hr",
+    prompt: `Act as a community-building strategist who has launched multiple successful Discord/Slack communities from zero. Help me set up a small community space for my early users. First, ask me: who are my users (consumers? developers? professionals?), what platform have they used before, and how big do I realistically expect this to get in 90 days. Then output: (1) a recommendation for which platform fits \u2014 Discord, Slack, Circle, etc. \u2014 with one-paragraph reasoning; (2) a starter channel/category structure (max 5-7 channels \u2014 don't over-build); (3) welcome message + rules + onboarding DM I can copy-paste and tweak; (4) a 30-day content plan: what I post each day for the first month so it doesn't go silent; (5) the exact list of 10-20 first people to hand-invite and a script for asking them; (6) red flags to watch for. Be opinionated and concrete \u2014 no vague "engage your community" platitudes.`,
+    what: "A central place (Discord, Slack, Circle, or even a private Telegram) where your users can hang out, ask questions, share what they're building with your tool, and run into you.",
+    why: "Engaged users become unpaid evangelists, your fastest source of product ideas, and your best customer support. They also stick around longer because they have a relationship, not just a tool.",
+    steps: [
+      "Pick one platform \u2014 don't spread yourself across three. Discord is most common for early-stage; Slack if your users are professionals.",
+      "Hand-invite your first 10\u201320 power users personally. Don't do a public push until there's something there.",
+      "Show up daily for the first month. Reply to every message. Welcome every new arrival by name.",
+      "Encourage members to help each other \u2014 celebrate it when they do.",
+      "Ship visible improvements based on community feedback and shout out the person who suggested it."
+    ],
+    redFlags: [
+      "Empty server because you started it before having users",
+      "You're absent \u2014 community goes silent without you",
+      "You're trying to be on Discord AND Slack AND Telegram (pick one)",
+      "No moderation plan \u2014 the first troll ruins the vibe for everyone",
+      "You ignore feedback even when it's consistent"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "Community quality is about real people, active moderation, and daily founder presence. The scanner cannot prove a Discord or Slack space is alive or useful."
+  },
+  {
+    id: "iteration",
+    number: 45,
+    title: "Plan what you'll improve in week 1",
+    category: "Growth",
+    priority: "lower",
+    timeEstimate: "30 min",
+    prompt: `Act as a product manager helping me build my first post-launch iteration plan. I'll give you: (1) my top 5 pieces of user feedback so far; (2) my top 3 bugs from error monitoring; (3) my top 1-2 drop-off points in analytics. If I haven't given you that data, ask me for it \u2014 don't guess. Then build me a one-page plan: (a) the 3 highest impact-per-effort fixes/improvements to do this week; (b) the 2-3 bigger items for next month; (c) the things I should explicitly NOT do right now and why (a "not now" list is as important as a to-do list); (d) a one-paragraph changelog template I can publish each Friday so users can see I'm shipping. Be ruthless about scope \u2014 I'd rather ship 3 things well than 10 things poorly.`,
+    what: "A short list of what you'll work on right after launch, based on what you learn from early users and analytics. Not a six-month roadmap \u2014 just \u201Chere are the next three things.\u201D",
+    why: "Without a plan you'll either freeze (paralyzed by all the feedback) or thrash (rebuilding the homepage every Monday). A simple iteration loop turns the chaos of launch into measurable forward motion.",
+    steps: [
+      "After your first week, sit down and review: top 5 pieces of feedback, top 3 bugs from error monitoring, top 1\u20132 drop-off points in analytics.",
+      "Pick the 3 things with the highest impact-per-effort. Ignore everything else for now.",
+      "Decide which are quick wins (do this week) vs. bigger lifts (next month).",
+      "Set a public next-update date so you have a forcing function.",
+      "Tell your users what changed when you ship \u2014 they want to know they were heard."
+    ],
+    redFlags: [
+      'No plan beyond "keep building"',
+      "Ignoring obvious problems multiple users have reported",
+      "Adding new features no one asked for instead of fixing what's broken",
+      "Silent updates \u2014 users don't know you're iterating",
+      "Pivoting your whole strategy based on one loud complainer"
+    ],
+    cliCoverage: "manual_only",
+    whyManual: "A week-one iteration plan depends on fresh user feedback, analytics, and bug data after launch. The scanner cannot know whether the roadmap reflects what users actually did."
+  },
+  {
+    id: "installable-app",
+    number: 46,
+    title: "Make your app installable on phones",
+    category: "Product & Launch",
+    priority: "lower",
+    timeEstimate: "30 min",
+    prompt: "Act as a frontend engineer. Make my web app a proper Progressive Web App (PWA) so phone users can install it to their home screen. Tasks: (1) create a /manifest.json with name, short_name (\u226412 chars), start_url: '/', display: 'standalone', background_color, theme_color matching my brand, and an icons array with at least 192\xD7192 and 512\xD7512 PNGs (generate them from my logo if I don't have them yet \u2014 lossless, transparent background). (2) add <link rel='manifest' href='/manifest.json'> and <meta name='theme-color' content='#yourbrand'> to <head>. (3) generate a proper favicon bundle: favicon.ico (multi-size), favicon.svg, apple-touch-icon.png (180\xD7180), and wire them into <head> with <link rel='icon'> and <link rel='apple-touch-icon'>. (4) verify in Chrome DevTools \u2192 Application \u2192 Manifest that every field validates and the install prompt appears. (5) test on a real phone: open in Safari or Chrome, use Share \u2192 'Add to Home Screen', confirm the app launches full-screen without the browser chrome. Report any warnings from Lighthouse's PWA audit.",
+    what: "A tiny /manifest.json plus proper-sized icons lets people add your site to their phone's home screen with one tap. When they launch it, it opens full-screen \u2014 no browser URL bar in the way \u2014 like a real app. Zero app-store submission needed.",
+    why: "Most vibe-coded sites stop at the default favicon and never get installed. Users who add your app to their home screen return two to three times more often than bookmark-only users \u2014 and it's a 30-minute setup to enable it forever. Also closes the subtle credibility gap of a generic browser favicon on your production URL.",
+    steps: [
+      "Generate your icon set: at minimum a 512\xD7512 PNG, a 192\xD7192 PNG, a 180\xD7180 apple-touch-icon.png, and a favicon.ico or favicon.svg. Transparent backgrounds.",
+      "Create a /manifest.json with your app name, short name (\u226412 chars), start URL, standalone display mode, theme color, and the icons.",
+      'Link it from <head>: <link rel="manifest" href="/manifest.json"> plus <meta name="theme-color" content="#yourbrand">.',
+      'Add <link rel="apple-touch-icon" href="/apple-touch-icon.png"> and <link rel="icon" href="/favicon.svg"> pointing at your icons.',
+      "Open Chrome DevTools \u2192 Application \u2192 Manifest and confirm every field validates with no warnings.",
+      "Open your site on a real phone, tap Share \u2192 Add to Home Screen, confirm it installs and launches full-screen."
+    ],
+    redFlags: [
+      "Default browser favicon still showing in the tab",
+      "No /manifest.json \u2014 iOS and Android can't install your site",
+      "Icons are the framework's starter logo (Next.js, Vite placeholder, etc.)",
+      "No apple-touch-icon \u2014 iPhone home-screen icon looks terrible",
+      "Manifest exists but references missing or wrong-size icons"
+    ],
+    cliCoverage: "automated"
+  }
+];
+
+// ../../lib/checklist-data/src/index.ts
+var CHECKLIST = [
+  ...ITEMS_CRITICAL,
+  ...ITEMS_HIGH,
+  ...ITEMS_MEDIUM,
+  ...ITEMS_LOWER
+];
+var CHECKLIST_BY_ID = Object.fromEntries(CHECKLIST.map((item) => [item.id, item]));
+
+// src/checks/make-finding.ts
+function makeFinding(input) {
+  const item = CHECKLIST_BY_ID[input.itemId];
+  const cliPrompt = item?.cliPrompt;
+  const out = {
+    checkId: input.checkId,
+    itemId: input.itemId,
+    severity: input.severity,
+    message: input.message
+  };
+  if (input.file) out.file = input.file;
+  if (input.line) out.line = input.line;
+  if (input.evidence) out.evidence = input.evidence;
+  if (cliPrompt) {
+    out.whatFailed = cliPrompt.whatFailed;
+    out.whyItBlocksLaunch = cliPrompt.whyItBlocksLaunch;
+    out.fixInstructions = cliPrompt.fixInstructions;
+    out.aiBuilderPrompt = cliPrompt.aiBuilderPrompt;
+    out.verificationStep = cliPrompt.verificationStep;
+  }
+  return out;
+}
+
 // src/checks/secrets.ts
 var SECRET_PATTERNS = [
   {
@@ -420,7 +1765,7 @@ async function checkHardcodedSecrets(ctx) {
       if (matchedRanges.some(([s, e]) => start < e && end > s)) continue;
       matchedRanges.push([start, end]);
       const line = findLine(content, start);
-      findings.push({
+      findings.push(makeFinding({
         checkId: `secret-${pat.id}`,
         itemId: "secrets",
         severity: pat.severity,
@@ -428,7 +1773,7 @@ async function checkHardcodedSecrets(ctx) {
         file: relPosix(file.relPath),
         line,
         evidence: `${m[0].slice(0, 6)}\u2026${m[0].slice(-4)} (${m[0].length} chars)`
-      });
+      }));
     }
     JWT_REGEX.lastIndex = 0;
     let jm;
@@ -441,7 +1786,7 @@ async function checkHardcodedSecrets(ctx) {
       const isServiceRole = !!payload && /"role"\s*:\s*"service_role"/.test(payload);
       const line = findLine(content, start);
       if (isServiceRole) {
-        findings.push({
+        findings.push(makeFinding({
           checkId: "secret-supabase-service-role-jwt",
           itemId: "secrets",
           severity: "critical",
@@ -449,9 +1794,9 @@ async function checkHardcodedSecrets(ctx) {
           file: relPosix(file.relPath),
           line,
           evidence: `${jm[0].slice(0, 6)}\u2026${jm[0].slice(-4)} (${jm[0].length} chars)`
-        });
+        }));
       } else {
-        findings.push({
+        findings.push(makeFinding({
           checkId: "secret-jwt",
           itemId: "secrets",
           severity: "high",
@@ -459,7 +1804,7 @@ async function checkHardcodedSecrets(ctx) {
           file: relPosix(file.relPath),
           line,
           evidence: `${jm[0].slice(0, 6)}\u2026${jm[0].slice(-4)} (${jm[0].length} chars)`
-        });
+        }));
       }
       break;
     }
@@ -485,8 +1830,13 @@ var HEX_SECRET_REGEX = /^[A-Fa-f0-9]{32,}$/;
 var BASE64_SECRET_REGEX = /^[A-Za-z0-9+/_-]{40,}={0,2}$/;
 var TEMPLATED_VALUE_REGEX = /\$\{[^}]+\}|\$[A-Za-z_][A-Za-z0-9_]*/;
 var CONFIG_KEY_ALLOWLIST = /* @__PURE__ */ new Set([
-  "DATABASE_URL"
+  "DATABASE_URL",
   // contains URL/host fragments, handled by other rules
+  "account_id",
+  // Cloudflare account id in wrangler.toml is public metadata
+  "database_id",
+  // Cloudflare D1 database ids are public resource ids
+  "CLOUDFLARE_ACCOUNT_ID"
 ]);
 async function checkConfigSecretLeaks(ctx) {
   const findings = [];
@@ -506,7 +1856,7 @@ async function checkConfigSecretLeaks(ctx) {
       if (TEMPLATED_VALUE_REGEX.test(value)) continue;
       const line = findLine(content, m.index);
       if (VITE_SECRET_KEY_REGEX.test(key)) {
-        findings.push({
+        findings.push(makeFinding({
           checkId: "config-vite-prefixed-secret",
           itemId: "secrets",
           severity: "high",
@@ -514,14 +1864,14 @@ async function checkConfigSecretLeaks(ctx) {
           file: relPosix(file.relPath),
           line,
           evidence: `${key}=${value.slice(0, 4)}\u2026${value.slice(-2)} (${value.length} chars)`
-        });
+        }));
         continue;
       }
       if (CONFIG_KEY_ALLOWLIST.has(key)) continue;
       const isHex = HEX_SECRET_REGEX.test(value);
       const isBase64 = BASE64_SECRET_REGEX.test(value);
       if (!isHex && !isBase64) continue;
-      findings.push({
+      findings.push(makeFinding({
         checkId: "config-hardcoded-credential",
         itemId: "secrets",
         severity: "critical",
@@ -529,7 +1879,7 @@ async function checkConfigSecretLeaks(ctx) {
         file: relPosix(file.relPath),
         line,
         evidence: `${key}=${value.slice(0, 4)}\u2026${value.slice(-2)} (${value.length} chars)`
-      });
+      }));
     }
   }
   return findings;
@@ -549,13 +1899,13 @@ async function checkEnvCommitted(ctx) {
     const base = path4.basename(file.relPath);
     if (base !== ".env" && base !== ".env.local" && base !== ".env.production") continue;
     if (!ignoresEnv) {
-      findings.push({
+      findings.push(makeFinding({
         checkId: "env-not-ignored",
         itemId: "secrets",
         severity: "high",
         message: `${base} found and your .gitignore does not appear to ignore .env files.`,
         file: relPosix(file.relPath)
-      });
+      }));
     }
   }
   return findings;
@@ -568,12 +1918,12 @@ async function checkEnvExample(ctx) {
   });
   if (hasEnv && !hasExample) {
     return [
-      {
+      makeFinding({
         checkId: "missing-env-example",
         itemId: "secrets",
         severity: "medium",
         message: "Found a .env file but no .env.example. Add a sanitized .env.example so collaborators know which variables are required."
-      }
+      })
     ];
   }
   return [];
@@ -582,12 +1932,12 @@ async function checkGitignore(ctx) {
   const gitignorePath = path4.join(ctx.rootDir, ".gitignore");
   if (!await fileExists(gitignorePath)) {
     return [
-      {
+      makeFinding({
         checkId: "missing-gitignore",
         itemId: "github",
         severity: "high",
         message: "No .gitignore at the project root. Add one tuned to your stack so you don't accidentally commit secrets, local DBs, or build artifacts."
-      }
+      })
     ];
   }
   return [];
@@ -638,12 +1988,12 @@ async function checkRobotsTxt(ctx) {
   const dirs = await findPublicDirs(ctx);
   if (dirs.length === 0) return [];
   return [
-    {
+    makeFinding({
       checkId: "missing-robots-txt",
       itemId: "seo",
       severity: "medium",
       message: `No robots.txt found in any public directory (looked in: ${dirs.join(", ")}). Add one so search engines know what to crawl.`
-    }
+    })
   ];
 }
 async function checkSitemapXml(ctx) {
@@ -654,12 +2004,12 @@ async function checkSitemapXml(ctx) {
   if (dirs.length === 0) return [];
   if (await hasDisallowAllRobots(ctx)) return [];
   return [
-    {
+    makeFinding({
       checkId: "missing-sitemap-xml",
       itemId: "seo",
       severity: "medium",
       message: `No sitemap.xml found in any public directory (looked in: ${dirs.join(", ")}). Add one to help search engines index your pages.`
-    }
+    })
   ];
 }
 async function checkFavicon(ctx) {
@@ -669,12 +2019,12 @@ async function checkFavicon(ctx) {
   const has = ctx.files.some((f) => faviconRegex.test(f.relPath));
   if (has) return [];
   return [
-    {
+    makeFinding({
       checkId: "missing-favicon",
       itemId: "launch-polish",
       severity: "lower",
       message: "No custom favicon found in your public directory. The default browser favicon (or the framework starter one) tells visitors this is an unfinished AI-built project."
-    }
+    })
   ];
 }
 async function checkLlmsTxt(ctx) {
@@ -684,12 +2034,12 @@ async function checkLlmsTxt(ctx) {
   const dirs = await findPublicDirs(ctx);
   if (dirs.length === 0) return [];
   return [
-    {
+    makeFinding({
       checkId: "missing-llms-txt",
       itemId: "aeo",
       severity: "lower",
       message: `No llms.txt found in any public directory (looked in: ${dirs.join(", ")}). Add one so AI crawlers (ChatGPT, Perplexity, Claude) can understand your site.`
-    }
+    })
   ];
 }
 async function checkPwaManifest(ctx) {
@@ -699,12 +2049,12 @@ async function checkPwaManifest(ctx) {
   const has = ctx.files.some((f) => manifestRegex.test(f.relPath));
   if (has) return [];
   return [
-    {
+    makeFinding({
       checkId: "missing-pwa-manifest",
       itemId: "installable-app",
       severity: "lower",
       message: `No PWA manifest found in any public directory (looked in: ${dirs.join(", ")}). Add manifest.json (or site.webmanifest) so users can install your app to their phone's home screen.`
-    }
+    })
   ];
 }
 
@@ -796,12 +2146,12 @@ async function checkSecurityHeaders(ctx) {
     }
   }
   return [
-    {
+    makeFinding({
       checkId: "missing-security-headers",
       itemId: "https-headers",
       severity: "high",
       message: "Couldn't find any common security headers (CSP, HSTS, X-Frame-Options, etc.) or helmet() middleware in your server/host configs. Add them so the browser enforces baseline defenses."
-    }
+    })
   ];
 }
 
@@ -837,11 +2187,21 @@ var DANGEROUS_PATTERNS = [
     message: "Shell execution via exec/execSync \u2014 if any argument includes user input, this is a command-injection path. Prefer execFile with an argument array, or validate input strictly against an allowlist."
   }
 ];
+function hasSafeDangerousHtmlContext(content, index) {
+  const before = content.slice(Math.max(0, index - 1200), index);
+  const after = content.slice(index, Math.min(content.length, index + 500));
+  if (/\b(DOMPurify|sanitizeHtml|sanitize)\b/.test(before + after)) {
+    return true;
+  }
+  return /<style[\s\S]{0,240}$/.test(before);
+}
 async function checkDangerousPatterns(ctx) {
   const findings = [];
   for (const file of ctx.files) {
     if (!isTextFile(file)) continue;
     if (isScanExempt(file.relPath)) continue;
+    if (isLikelyNonRuntimePath(file.relPath)) continue;
+    if (isUiLibraryPrimitive(file.relPath)) continue;
     const ext = path6.extname(file.relPath).toLowerCase();
     if (![
       ".ts",
@@ -860,15 +2220,18 @@ async function checkDangerousPatterns(ctx) {
       const m = pat.regex.exec(content);
       if (!m) continue;
       if (lineContainsIgnoreMarker(content, m.index)) continue;
+      if (pat.id === "dangerously-set-inner-html" && hasSafeDangerousHtmlContext(content, m.index)) {
+        continue;
+      }
       const line = findLine(content, m.index);
-      findings.push({
+      findings.push(makeFinding({
         checkId: pat.id,
         itemId: pat.itemId,
         severity: pat.severity,
         message: pat.message,
         file: relPosix(file.relPath),
         line
-      });
+      }));
     }
   }
   return findings;
@@ -974,14 +2337,14 @@ async function checkLanguagePatterns(ctx) {
       const m = pat.regex.exec(content);
       if (!m) continue;
       const line = findLine(content, m.index);
-      findings.push({
+      findings.push(makeFinding({
         checkId: pat.id,
         itemId: pat.itemId,
         severity: pat.severity,
         message: pat.message,
         file: relPosix(file.relPath),
         line
-      });
+      }));
     }
   }
   return findings;
@@ -1039,24 +2402,24 @@ async function checkPythonSecretKeyEnv(ctx) {
   if (envBacked) return [];
   if (!mentionsSecretKey) {
     return [
-      {
+      makeFinding({
         checkId: "py-missing-secret-key-env",
         itemId: "secrets",
         severity: "high",
         message: "Detected a Django/Flask project but couldn't find SECRET_KEY anywhere in your settings. Configure it from an env var (e.g. os.environ['SECRET_KEY']) before deploying.",
         file: relPosix(candidates[0].file.relPath)
-      }
+      })
     ];
   }
   return [
-    {
+    makeFinding({
       checkId: "py-secret-key-not-from-env",
       itemId: "secrets",
       severity: "high",
       message: "Django/Flask SECRET_KEY is set in source but not read from an environment variable. Pull it from os.environ / os.getenv (or python-decouple / django-environ) so the real value stays out of the repo.",
       file: firstMention ? relPosix(firstMention.file.relPath) : void 0,
       line: firstMention?.line
-    }
+    })
   ];
 }
 function isRailsProject(_ctx, files) {
@@ -1105,23 +2468,23 @@ async function checkRubySecretKeyBaseEnv(ctx) {
   if (envBacked) return [];
   if (!mentionsSecret) {
     return [
-      {
+      makeFinding({
         checkId: "rb-missing-secret-key-base-env",
         itemId: "secrets",
         severity: "high",
         message: "Detected a Rails project but couldn't find secret_key_base wired up to ENV['SECRET_KEY_BASE'] or Rails.application.credentials anywhere in config/. Configure it before deploying."
-      }
+      })
     ];
   }
   return [
-    {
+    makeFinding({
       checkId: "rb-secret-key-base-not-from-env",
       itemId: "secrets",
       severity: "high",
       message: "Rails secret_key_base is referenced in config/ but not pulled from ENV['SECRET_KEY_BASE'] or Rails.application.credentials. Move the real value out of source.",
       file: firstMention ? relPosix(firstMention.file.relPath) : void 0,
       line: firstMention?.line
-    }
+    })
   ];
 }
 
@@ -1136,31 +2499,32 @@ async function checkPlaceholderContent(ctx) {
   for (const file of ctx.files) {
     if (!isTextFile(file)) continue;
     if (isScanExempt(file.relPath)) continue;
+    if (isLikelyNonRuntimePath(file.relPath)) continue;
     const ext = path8.extname(file.relPath).toLowerCase();
-    if (![".ts", ".tsx", ".js", ".jsx", ".html", ".md", ".mdx"].includes(ext)) continue;
+    if (![".ts", ".tsx", ".js", ".jsx", ".html"].includes(ext)) continue;
     const content = await readFileSafe(file);
     if (!content) continue;
     const todoMatch = TODO_REGEX.exec(content);
     if (todoMatch && !lineContainsIgnoreMarker(content, todoMatch.index)) todoCount++;
     const phMatch = PLACEHOLDER_REGEX.exec(content);
     if (phMatch && !lineContainsIgnoreMarker(content, phMatch.index)) {
-      placeholderHits.push({
+      placeholderHits.push(makeFinding({
         checkId: "placeholder-content",
         itemId: "ai-audit",
         severity: "medium",
         message: `Placeholder content "${phMatch[0]}" found \u2014 make sure it isn't shown to real users.`,
         file: relPosix(file.relPath),
         line: findLine(content, phMatch.index)
-      });
+      }));
     }
   }
   if (todoCount > 0) {
-    findings.push({
+    findings.push(makeFinding({
       checkId: "todo-comments",
       itemId: "ai-audit",
       severity: "lower",
       message: `Found ${todoCount} file(s) with TODO/FIXME/XXX/HACK comments. Walk through them before launch and decide which are real work.`
-    });
+    }));
   }
   return findings.concat(placeholderHits.slice(0, 25));
 }
@@ -1174,8 +2538,6 @@ var SCANNABLE_EXTENSIONS = /* @__PURE__ */ new Set([
   ".jsx",
   ".mjs",
   ".cjs",
-  ".md",
-  ".mdx",
   ".html",
   ".htm",
   ".vue",
@@ -1193,13 +2555,13 @@ var SCANNABLE_EXTENSIONS = /* @__PURE__ */ new Set([
 var OTP_CONTEXT = /\b(otp|one[-\s]?time(?: password| code)?|verification code|verify code|login code|magic code|passcode|2fa|mfa|two[-\s]?factor)\b/i;
 var AUTH_CONTEXT = /\b(auth|sign[-\s]?in|signin|login|session|protected route|private route)\b/i;
 var SMS_OR_PHONE_CONTEXT = /\b(sms|text message|twilio|phone|mobile number|mobile phone|PhoneInput)\b/i;
-var PAID_REPORT_CONTEXT = /\b(paid report|report access|checkout handoff|checkoutHandoff|Stripe checkout|checkout email|checkout phone|checkout mobile|retrieve your report|account\/purchases|report session)\b/i;
+var PAID_REPORT_CONTEXT = /\b(paid report|report access|checkout handoff|checkoutHandoff|retrieve your report|account\/purchases|report session)\b/i;
 var FRONTEND_PATH_CONTEXT = /(^|\/)(login|signin|sign-in|auth|account|report|checkout)[^/]*\.(tsx|jsx|html|vue|svelte|astro)$/i;
 var PHONE_NORMALIZATION = /\b(normalizePhone|libphonenumber|parsePhoneNumber|isValidPhoneNumber|PhoneInput|E\.164|e164|react-phone-number-input|AsYouType)\b/i;
 var RESEND_BEHAVIOR = /\b(resend|send another|send a new code|request another|retry-after|try again in|wait a minute|cooldown|backoff)\b/i;
 var RATE_LIMIT = /\b(rateLimit|rate limit|Too many requests|retry-after|429|throttl|attempt limit|cooldown)\b/i;
 var ANTI_ENUMERATION = /\b(anti[-\s]?enumeration|success[-\s]?shaped|generic response|do not reveal|without revealing|hasPaidPurchase|no paid purchase|paid purchases|return\s+\{?\s*ok:\s*true|res\.json\(\s*\{\s*ok:\s*true)\b/i;
-var ENUMERATION_LEAK = /\b(?:user|account|email|phone|checkout|purchase|report)\s+(?:not\s+found|does\s+not\s+exist|not\s+recognized|not\s+registered|has no paid|has no purchase|not paid)|\bno\s+(?:account|user|purchase|paid checkout)\b/i;
+var ENUMERATION_LEAK = /\b(?:user|account|email|phone|checkout|purchase|report)\s+(?:not\s+found|does\s+not\s+exist|not\s+recognized|not\s+registered|has no paid|has no purchase|not paid)|\bno\s+(?:account|user(?!-)|purchase|paid checkout)\b/i;
 var MOBILE_OTP_INPUT = /\b(inputMode|inputmode|one-time-code|autocomplete=["']one-time-code|maxLength\s*=\s*\{?\s*6|type=["']tel|pattern=["'][^"']*\\d|InputOTP|numeric)\b/i;
 var CLEAR_COPY = /\b(6[-\s]?digit|six[-\s]?digit|verification code|one[-\s]?time code|code expires|expires? in|latest code|checkout email|checkout mobile|same email|same mobile|SMS code|Email code|Stripe receipt)\b/i;
 var RECOVERY_PATH = /\b(support|receipt|fallback|email fallback|alternate channel|try email|try sms|contact us|restart checkout|fulfillment|purchase history|account\/purchases|returnTo|different contact)\b/i;
@@ -1207,6 +2569,8 @@ var DELIVERY_VERIFICATION = /\b(deliverability|delivery|delivered|arrives?|smoke
 function shouldScan(file) {
   if (!isTextFile(file)) return false;
   if (isScanExempt(file.relPath)) return false;
+  if (isLikelyNonRuntimePath(file.relPath)) return false;
+  if (isUiLibraryPrimitive(file.relPath)) return false;
   const ext = path9.extname(file.relPath).toLowerCase();
   return SCANNABLE_EXTENSIONS.has(ext);
 }
@@ -1228,14 +2592,14 @@ function evidence(hit, fallback) {
   return `${hit.file}:${hit.line} matched "${hit.text}".`;
 }
 function finding(input) {
-  return {
+  return makeFinding({
     checkId: input.checkId,
     itemId: "secure-auth",
     severity: input.severity,
     message: input.message,
     evidence: input.evidence,
     ...input.hit ? { file: input.hit.file, line: input.hit.line } : {}
-  };
+  });
 }
 async function collectOtpAuthSignals(ctx) {
   const signals = {
@@ -1254,13 +2618,16 @@ async function collectOtpAuthSignals(ctx) {
     const smsHit = firstHit(file, content, SMS_OR_PHONE_CONTEXT);
     const paidHit = firstHit(file, content, PAID_REPORT_CONTEXT);
     const frontendContext = FRONTEND_PATH_CONTEXT.test(rel);
-    signals.hasOtp = signals.hasOtp || Boolean(otpHit);
+    const otpFlowHit = Boolean(
+      otpHit && (authHit || smsHit || paidHit || frontendContext)
+    );
+    signals.hasOtp = signals.hasOtp || otpFlowHit;
     signals.hasSmsOrPhone = signals.hasSmsOrPhone || Boolean(smsHit);
     signals.hasPaidReportOtp = signals.hasPaidReportOtp || Boolean(paidHit && (otpHit || authHit));
     signals.hasFrontendOtp = signals.hasFrontendOtp || Boolean(frontendContext && (otpHit || authHit));
     signals.contextHit = pick(
       signals.contextHit,
-      otpHit ?? paidHit ?? authHit ?? smsHit
+      (otpFlowHit ? otpHit : void 0) ?? paidHit ?? authHit ?? smsHit
     );
     signals.phoneNormalization = pick(
       signals.phoneNormalization,
@@ -1417,47 +2784,727 @@ async function checkOtpAuthReadiness(ctx) {
   return findings;
 }
 
-// src/checks/index.ts
-var ALL_CHECKS = [
-  { id: "hardcoded-secrets", run: checkHardcodedSecrets },
-  { id: "config-secret-leaks", run: checkConfigSecretLeaks },
-  { id: "env-committed", run: checkEnvCommitted },
-  { id: "env-example", run: checkEnvExample },
-  { id: "gitignore", run: checkGitignore },
-  { id: "robots-txt", run: checkRobotsTxt },
-  { id: "sitemap-xml", run: checkSitemapXml },
-  { id: "favicon", run: checkFavicon },
-  { id: "llms-txt", run: checkLlmsTxt },
-  { id: "pwa-manifest", run: checkPwaManifest },
-  { id: "security-headers", run: checkSecurityHeaders },
-  { id: "dangerous-patterns", run: checkDangerousPatterns },
-  { id: "language-patterns", run: checkLanguagePatterns },
-  { id: "python-secret-key-env", run: checkPythonSecretKeyEnv },
-  { id: "ruby-secret-key-base-env", run: checkRubySecretKeyBaseEnv },
-  { id: "placeholder-content", run: checkPlaceholderContent },
-  { id: "otp-auth-readiness", run: checkOtpAuthReadiness }
+// src/checks/api-spend-cap.ts
+import * as path10 from "node:path";
+var PAID_AI_HOSTS = [
+  { host: "api.openai.com", provider: "OpenAI" },
+  { host: "api.anthropic.com", provider: "Anthropic" },
+  { host: "api.replicate.com", provider: "Replicate" },
+  { host: "api.stability.ai", provider: "Stability AI" },
+  { host: "api.mistral.ai", provider: "Mistral" },
+  { host: "generativelanguage.googleapis.com", provider: "Google Gemini" },
+  { host: "api.cohere.ai", provider: "Cohere" },
+  { host: "api.cohere.com", provider: "Cohere" },
+  { host: "api.together.xyz", provider: "Together AI" },
+  { host: "openrouter.ai", provider: "OpenRouter" },
+  { host: "api.groq.com", provider: "Groq" },
+  { host: "api.fireworks.ai", provider: "Fireworks" }
+];
+var PAID_AI_SDK_PATTERNS = [
+  { regex: /\bnew\s+OpenAI\s*\(/, provider: "OpenAI" },
+  { regex: /\bnew\s+Anthropic\s*\(/, provider: "Anthropic" },
+  { regex: /\b@anthropic-ai\/sdk\b/, provider: "Anthropic" },
+  { regex: /\bfrom\s+["']openai["']/, provider: "OpenAI" },
+  { regex: /\bfrom\s+["']@anthropic-ai\/sdk["']/, provider: "Anthropic" },
+  { regex: /\bnew\s+Replicate\s*\(/, provider: "Replicate" },
+  { regex: /\b@google\/generative-ai\b/, provider: "Google Gemini" },
+  { regex: /\bnew\s+CohereClient\s*\(/, provider: "Cohere" }
 ];
+var MITIGATION_REGEX = /\b(rateLimit|spendCap|rate-limit|spend-cap|rate_limit|spend_cap|express-rate-limit|@upstash\/ratelimit|@vercel\/edge|fastify-rate-limit|hono\/ratelimit|throttle|throttler|maxRequests|maxRequestsPerMinute|tokensPerMinute|tokensPerSecond|requestsPerMinute|requestsPerSecond|RateLimiter|Bottleneck|p-limit|p-throttle|limiter\(|ratelimit\(|withRateLimit|guard\b|budget\b|usageCap)\b/i;
+var RUNTIME_EXTS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".py",
+  ".rb",
+  ".go",
+  ".php"
+]);
+function hasMitigationNearby(content, hitIndex) {
+  const start = Math.max(0, hitIndex - 600);
+  const end = Math.min(content.length, hitIndex + 600);
+  return MITIGATION_REGEX.test(content.slice(start, end));
+}
+async function checkApiSpendCap(ctx) {
+  const findings = [];
+  const seenFiles = /* @__PURE__ */ new Set();
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    if (isScanExempt(file.relPath)) continue;
+    if (isLikelyNonRuntimePath(file.relPath)) continue;
+    if (isUiLibraryPrimitive(file.relPath)) continue;
+    const ext = path10.extname(file.relPath).toLowerCase();
+    if (!RUNTIME_EXTS.has(ext)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    let hitIndex = -1;
+    let providerLabel = "";
+    let detectionShape = "host";
+    for (const { host, provider } of PAID_AI_HOSTS) {
+      const idx = content.indexOf(host);
+      if (idx === -1) continue;
+      hitIndex = idx;
+      providerLabel = provider;
+      break;
+    }
+    if (hitIndex === -1) {
+      for (const { regex, provider } of PAID_AI_SDK_PATTERNS) {
+        const m = regex.exec(content);
+        if (!m) continue;
+        hitIndex = m.index;
+        providerLabel = provider;
+        detectionShape = "sdk";
+        break;
+      }
+    }
+    if (hitIndex === -1) continue;
+    if (hasMitigationNearby(content, hitIndex)) continue;
+    const rel = relPosix(file.relPath);
+    if (seenFiles.has(rel)) continue;
+    seenFiles.add(rel);
+    const line = findLine(content, hitIndex);
+    const detectionDescriptor = detectionShape === "host" ? `Direct call to ${providerLabel} (paid API host)` : `${providerLabel} SDK in use`;
+    findings.push(
+      makeFinding({
+        checkId: "api-spend-cap-missing",
+        itemId: "api-spend-cap",
+        severity: "high",
+        message: `${detectionDescriptor} without a visible rate-limit, spend-cap, or throttle signal nearby. An attacker (or a runaway loop) can burn paid credits faster than your billing alerts fire.`,
+        file: rel,
+        line,
+        evidence: `${detectionDescriptor} at ${rel}:${line}. No rate-limit / spend-cap signal within +/- 600 chars.`
+      })
+    );
+  }
+  return findings;
+}
 
-// src/items.ts
-var CHECKLIST_ITEMS = {
-  secrets: {
-    id: "secrets",
-    title: "Lock up your API keys and passwords",
-    priority: "critical"
-  },
-  "common-attacks": {
-    id: "common-attacks",
-    title: "Block the most common automated attacks",
-    priority: "critical"
-  },
-  "https-headers": {
-    id: "https-headers",
-    title: "Force HTTPS and add browser-level defenses",
-    priority: "critical"
-  },
-  "dev-prod-data": {
-    id: "dev-prod-data",
-    title: "Keep your test data away from real users",
+// src/checks/rate-limiting.ts
+import * as path11 from "node:path";
+var SERVER_FRAMEWORK_DEPS = /* @__PURE__ */ new Set([
+  "express",
+  "fastify",
+  "hono",
+  "koa",
+  "@nestjs/core",
+  "next",
+  "@sveltejs/kit",
+  "astro",
+  "@hono/node-server",
+  "@trpc/server",
+  "elysia",
+  "h3"
+]);
+var RATE_LIMIT_DEPS = /* @__PURE__ */ new Set([
+  "express-rate-limit",
+  "@upstash/ratelimit",
+  "fastify-rate-limit",
+  "@fastify/rate-limit",
+  "hono-rate-limiter",
+  "rate-limiter-flexible",
+  "express-slow-down",
+  "@vercel/firewall",
+  "@arcjet/next",
+  "@arcjet/node",
+  "@arcjet/sveltekit",
+  "@arcjet/bun",
+  "p-limit",
+  "p-throttle",
+  "bottleneck",
+  "limiter",
+  "@upstash/redis"
+]);
+var RATE_LIMIT_SOURCE_REGEX = /\b(rateLimit\(|rateLimiter\(|@upstash\/ratelimit|express-rate-limit|fastify-rate-limit|@arcjet|RateLimiter\(|new\s+Bottleneck\s*\(|throttle\(|withRateLimit)\b/i;
+function depsFromPackage(pkg) {
+  const all = /* @__PURE__ */ new Set();
+  for (const dep of [
+    pkg.dependencies,
+    pkg.devDependencies,
+    pkg.peerDependencies
+  ]) {
+    if (!dep) continue;
+    for (const name of Object.keys(dep)) all.add(name);
+  }
+  return all;
+}
+async function checkRateLimiting(ctx) {
+  const pkgFile = ctx.files.find(
+    (f) => relPosix(f.relPath) === "package.json"
+  );
+  if (!pkgFile) return [];
+  const pkgRaw = await readFileSafe(pkgFile);
+  if (!pkgRaw) return [];
+  let pkg;
+  try {
+    pkg = JSON.parse(pkgRaw);
+  } catch {
+    return [];
+  }
+  const deps = depsFromPackage(pkg);
+  const hasServerFramework = [...deps].some(
+    (d) => SERVER_FRAMEWORK_DEPS.has(d)
+  );
+  if (!hasServerFramework) return [];
+  const hasRateLimitDep = [...deps].some((d) => RATE_LIMIT_DEPS.has(d));
+  if (hasRateLimitDep) return [];
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    const ext = path11.extname(file.relPath).toLowerCase();
+    if (![".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].includes(ext)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    if (RATE_LIMIT_SOURCE_REGEX.test(content)) return [];
+  }
+  return [
+    makeFinding({
+      checkId: "rate-limit-missing",
+      itemId: "rate-limiting",
+      severity: "high",
+      message: "No rate-limit dependency or in-source throttle was detected. A public API without rate limits will be brute-forced or scraped within days of launch.",
+      file: "package.json",
+      evidence: "package.json declares a server framework (express / fastify / hono / next / etc.) but no rate-limit package and no rate-limit source signal was found."
+    })
+  ];
+}
+
+// src/checks/error-monitoring.ts
+var ERROR_MONITORING_DEPS = /* @__PURE__ */ new Set([
+  "@sentry/node",
+  "@sentry/nextjs",
+  "@sentry/react",
+  "@sentry/browser",
+  "@sentry/sveltekit",
+  "@sentry/astro",
+  "@sentry/remix",
+  "@sentry/bun",
+  "@sentry/vite-plugin",
+  "@bugsnag/js",
+  "@bugsnag/node",
+  "@bugsnag/react",
+  "rollbar",
+  "@datadog/browser-rum",
+  "dd-trace",
+  "@honeybadger-io/js",
+  "@honeybadger-io/react",
+  "@highlight-run/node",
+  "@highlight-run/react",
+  "@logsnag/node",
+  "@axiomhq/js",
+  "@axiomhq/react",
+  "newrelic",
+  "elastic-apm-node",
+  "@opentelemetry/api"
+]);
+var ERROR_MONITORING_SOURCE_REGEX = /\b(Sentry\.init|Sentry\.captureException|Bugsnag\.start|bugsnag\(|Rollbar\.init|Honeybadger\.configure|datadogRum\.init|newrelic\.recordCustomEvent|tracer\.init|@sentry\/|@bugsnag\/|@datadog\/|@highlight-run\/|@honeybadger-io)\b/i;
+async function checkErrorMonitoring(ctx) {
+  const pkgFile = ctx.files.find(
+    (f) => relPosix(f.relPath) === "package.json"
+  );
+  if (!pkgFile) return [];
+  const pkgRaw = await readFileSafe(pkgFile);
+  if (!pkgRaw) return [];
+  let pkg;
+  try {
+    pkg = JSON.parse(pkgRaw);
+  } catch {
+    return [];
+  }
+  const deps = /* @__PURE__ */ new Set([
+    ...Object.keys(pkg.dependencies ?? {}),
+    ...Object.keys(pkg.devDependencies ?? {})
+  ]);
+  if ([...deps].some((d) => ERROR_MONITORING_DEPS.has(d))) return [];
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    if (ERROR_MONITORING_SOURCE_REGEX.test(content)) return [];
+  }
+  return [
+    makeFinding({
+      checkId: "error-monitoring-missing",
+      itemId: "error-monitoring",
+      severity: "medium",
+      message: "No error-monitoring SDK detected (Sentry / Bugsnag / Rollbar / Datadog / Honeybadger / Highlight / etc.). Production errors that don't get captured become silent failures and shipping bugs.",
+      file: "package.json",
+      evidence: "package.json has no error-monitoring dependency and no error-tracking source signal was found."
+    })
+  ];
+}
+
+// src/checks/legal-pages.ts
+import * as path12 from "node:path";
+var LEGAL_FILE_PATTERNS = [
+  { regex: /\/(terms|tos|terms-of-service)(\.[a-z]+)?(\/|$)/i, itemKind: "terms" },
+  { regex: /\/privacy(-policy)?(\.[a-z]+)?(\/|$)/i, itemKind: "privacy" }
+];
+var LEGAL_LINK_PATTERNS = [
+  { regex: /href=["']\/(terms|tos|terms-of-service)\b/i, itemKind: "terms" },
+  { regex: /href=["']\/privacy(-policy)?\b/i, itemKind: "privacy" },
+  { regex: /to=["']\/(terms|tos)\b/i, itemKind: "terms" },
+  { regex: /to=["']\/privacy\b/i, itemKind: "privacy" }
+];
+var RUNTIME_EXTS2 = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".html",
+  ".astro",
+  ".svelte",
+  ".vue"
+]);
+async function checkLegalPages(ctx) {
+  const hasPkg = ctx.files.some(
+    (f) => relPosix(f.relPath) === "package.json"
+  );
+  if (!hasPkg) return [];
+  const found = /* @__PURE__ */ new Set();
+  for (const file of ctx.files) {
+    const rel = relPosix(file.relPath).toLowerCase();
+    for (const { regex, itemKind } of LEGAL_FILE_PATTERNS) {
+      if (regex.test(rel)) found.add(itemKind);
+    }
+    if (found.size === 2) break;
+  }
+  if (found.size < 2) {
+    for (const file of ctx.files) {
+      if (found.size === 2) break;
+      if (!isTextFile(file)) continue;
+      const ext = path12.extname(file.relPath).toLowerCase();
+      if (!RUNTIME_EXTS2.has(ext)) continue;
+      const content = await readFileSafe(file);
+      if (!content) continue;
+      for (const { regex, itemKind } of LEGAL_LINK_PATTERNS) {
+        if (regex.test(content)) found.add(itemKind);
+      }
+    }
+  }
+  const findings = [];
+  if (!found.has("terms")) {
+    findings.push(
+      makeFinding({
+        checkId: "legal-page-terms-missing",
+        itemId: "legal-pages",
+        severity: "medium",
+        message: "No Terms of Service route or link detected. If you take payment, run a marketplace, or collect user data, terms are a baseline expectation.",
+        evidence: "No /terms, /tos, or /terms-of-service route file was found, and no source file linked to one."
+      })
+    );
+  }
+  if (!found.has("privacy")) {
+    findings.push(
+      makeFinding({
+        checkId: "legal-page-privacy-missing",
+        itemId: "legal-pages",
+        severity: "medium",
+        message: "No Privacy Policy route or link detected. EU GDPR, US state laws, and most app store / payment processor policies require a published privacy notice.",
+        evidence: "No /privacy or /privacy-policy route file was found, and no source file linked to one."
+      })
+    );
+  }
+  return findings;
+}
+
+// src/checks/payments-webhook.ts
+import * as path13 from "node:path";
+var WEBHOOK_HANDLER_REGEX = /(app|router)\.(post|use)\s*\(\s*["'`][^"'`]*\/(webhook|stripe[\w-]*hook[\w-]*|hooks\/stripe)/i;
+var SIGNATURE_VERIFY_REGEX = /\b(stripe\.webhooks\.constructEvent|Webhook\.constructEvent|webhooks\.constructEvent|verifyHeader\s*\(|constructEventAsync)\b/;
+var RUNTIME_EXTS3 = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
+async function checkPaymentsWebhook(ctx) {
+  const pkgFile = ctx.files.find(
+    (f) => relPosix(f.relPath) === "package.json"
+  );
+  if (!pkgFile) return [];
+  const pkgRaw = await readFileSafe(pkgFile);
+  if (!pkgRaw) return [];
+  let pkg;
+  try {
+    pkg = JSON.parse(pkgRaw);
+  } catch {
+    return [];
+  }
+  const deps = /* @__PURE__ */ new Set([
+    ...Object.keys(pkg.dependencies ?? {}),
+    ...Object.keys(pkg.devDependencies ?? {})
+  ]);
+  const usesStripe = deps.has("stripe") || deps.has("@stripe/stripe-js");
+  if (!usesStripe) return [];
+  const findings = [];
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    if (isScanExempt(file.relPath)) continue;
+    if (isLikelyNonRuntimePath(file.relPath)) continue;
+    if (isUiLibraryPrimitive(file.relPath)) continue;
+    const ext = path13.extname(file.relPath).toLowerCase();
+    if (!RUNTIME_EXTS3.has(ext)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    const handlerMatch = WEBHOOK_HANDLER_REGEX.exec(content);
+    if (!handlerMatch) continue;
+    const start = Math.max(0, handlerMatch.index - 200);
+    const end = Math.min(content.length, handlerMatch.index + 2e3);
+    const window = content.slice(start, end);
+    if (SIGNATURE_VERIFY_REGEX.test(window)) continue;
+    const rel = relPosix(file.relPath);
+    const line = findLine(content, handlerMatch.index);
+    findings.push(
+      makeFinding({
+        checkId: "stripe-webhook-signature-missing",
+        itemId: "payments",
+        severity: "high",
+        message: "Stripe is installed and a webhook-shaped route is bound here, but no `stripe.webhooks.constructEvent(...)` / signature-verify call was found within ~2000 characters of the handler. Without signature verification, anyone can POST a forged webhook to grant entitlements or trigger fulfillment. Owner must verify the verify call exists in the actual flow this route uses.",
+        file: rel,
+        line,
+        evidence: `Webhook-shaped route bound at ${rel}:${line}. No 'stripe.webhooks.constructEvent' / 'Webhook.constructEvent' / 'verifyHeader(' call in the surrounding window.`
+      })
+    );
+    return findings;
+  }
+  return findings;
+}
+
+// src/checks/file-uploads.ts
+import * as path14 from "node:path";
+var UPLOAD_LIBRARY_DEPS = /* @__PURE__ */ new Set([
+  "multer",
+  "busboy",
+  "formidable",
+  "@fastify/multipart",
+  "express-fileupload",
+  "@hono/node-server",
+  "uploadthing",
+  "@uploadthing/react",
+  "react-dropzone"
+]);
+var UPLOAD_USAGE_PATTERNS = [
+  { regex: /\bmulter\s*\(/, provider: "multer" },
+  { regex: /\bnew\s+Busboy\s*\(/, provider: "busboy" },
+  { regex: /\bnew\s+IncomingForm\s*\(/, provider: "formidable" },
+  { regex: /\bcreateUploadthing\s*\(/, provider: "uploadthing" },
+  { regex: /\bregisterMultipartFormParser\s*\(/, provider: "@fastify/multipart" },
+  {
+    regex: /\bapp\.use\s*\(\s*fileUpload\s*\(/,
+    provider: "express-fileupload"
+  }
+];
+var SIZE_LIMIT_REGEX = /\b(limits\s*:\s*\{|fileSize\s*[:=]\s*[0-9]|maxFileSize|maxSize|maxBytes|fieldSize|maxFiles\s*[:=])\b/;
+var TYPE_FILTER_REGEX = /\b(mimetype|allowedMimeTypes|fileFilter|allowedExtensions|acceptedFileTypes|accept\s*[:=]\s*\[)\b/i;
+var RUNTIME_EXTS4 = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
+async function checkFileUploads(ctx) {
+  const pkgFile = ctx.files.find(
+    (f) => relPosix(f.relPath) === "package.json"
+  );
+  if (!pkgFile) return [];
+  const pkgRaw = await readFileSafe(pkgFile);
+  if (!pkgRaw) return [];
+  let pkg;
+  try {
+    pkg = JSON.parse(pkgRaw);
+  } catch {
+    return [];
+  }
+  const deps = /* @__PURE__ */ new Set([
+    ...Object.keys(pkg.dependencies ?? {}),
+    ...Object.keys(pkg.devDependencies ?? {})
+  ]);
+  const hasUploadDep = [...deps].some((d) => UPLOAD_LIBRARY_DEPS.has(d));
+  if (!hasUploadDep) return [];
+  const findings = [];
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    if (isScanExempt(file.relPath)) continue;
+    if (isLikelyNonRuntimePath(file.relPath)) continue;
+    if (isUiLibraryPrimitive(file.relPath)) continue;
+    const ext = path14.extname(file.relPath).toLowerCase();
+    if (!RUNTIME_EXTS4.has(ext)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    let usageHit = null;
+    for (const { regex, provider } of UPLOAD_USAGE_PATTERNS) {
+      const m = regex.exec(content);
+      if (m) {
+        usageHit = { index: m.index, provider };
+        break;
+      }
+    }
+    if (!usageHit) continue;
+    const start = Math.max(0, usageHit.index - 400);
+    const end = Math.min(content.length, usageHit.index + 1200);
+    const window = content.slice(start, end);
+    const hasSizeLimit = SIZE_LIMIT_REGEX.test(window);
+    const hasTypeFilter = TYPE_FILTER_REGEX.test(window);
+    if (hasSizeLimit && hasTypeFilter) continue;
+    const rel = relPosix(file.relPath);
+    const line = findLine(content, usageHit.index);
+    const missing = [];
+    if (!hasSizeLimit) missing.push("size limit");
+    if (!hasTypeFilter) missing.push("MIME / extension filter");
+    findings.push(
+      makeFinding({
+        checkId: "file-upload-guards-missing",
+        itemId: "file-uploads",
+        severity: "medium",
+        message: `${usageHit.provider} upload usage detected with no obvious ${missing.join(" and ")} nearby. Untyped or unbounded uploads can fill disk, smuggle malware, or trigger expensive processing pipelines. Owner must verify limits exist somewhere in the chain (CDN, edge config, or different file).`,
+        file: rel,
+        line,
+        evidence: `${usageHit.provider} upload call at ${rel}:${line}. No ${missing.join(" / ")} signal in the surrounding window.`
+      })
+    );
+    return findings;
+  }
+  return findings;
+}
+
+// src/checks/session-cookie.ts
+import * as path15 from "node:path";
+var COOKIE_SET_PATTERNS = [
+  {
+    regex: /\bres\.cookie\s*\(\s*[^)]+\)/m,
+    shape: "Express res.cookie(...)"
+  },
+  {
+    regex: /\bsetCookie\s*\(\s*[^)]+\)/m,
+    shape: "setCookie(...) call"
+  },
+  {
+    regex: /\bcookies\s*\(\s*\)\.set\s*\(/m,
+    shape: "Next.js cookies().set(...)"
+  }
+];
+var SESSION_CONFIG_REGEX = /\bcookie\s*:\s*\{[\s\S]{0,400}\}/g;
+var RUNTIME_EXTS5 = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
+function evaluateCookieBlock(block) {
+  const missing = [];
+  const insecure = [];
+  if (!/httpOnly\s*[:=]/i.test(block)) {
+    missing.push("httpOnly");
+  } else if (/httpOnly\s*[:=]\s*(false|0)/i.test(block)) {
+    insecure.push("httpOnly: false (JS-readable, exposed to XSS)");
+  }
+  if (!/secure\s*[:=]/i.test(block)) {
+    missing.push("secure");
+  } else if (/secure\s*[:=]\s*(false|0)/i.test(block)) {
+    insecure.push("secure: false (will travel over plain HTTP)");
+  }
+  if (!/sameSite\s*[:=]/i.test(block)) {
+    missing.push("sameSite");
+  }
+  return { missing, insecure };
+}
+async function checkSessionCookie(ctx) {
+  const findings = [];
+  const seenFiles = /* @__PURE__ */ new Set();
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    if (isScanExempt(file.relPath)) continue;
+    if (isLikelyNonRuntimePath(file.relPath)) continue;
+    if (isUiLibraryPrimitive(file.relPath)) continue;
+    const ext = path15.extname(file.relPath).toLowerCase();
+    if (!RUNTIME_EXTS5.has(ext)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    const rel = relPosix(file.relPath);
+    if (seenFiles.has(rel)) continue;
+    let match;
+    SESSION_CONFIG_REGEX.lastIndex = 0;
+    while ((match = SESSION_CONFIG_REGEX.exec(content)) !== null) {
+      const { missing, insecure } = evaluateCookieBlock(match[0]);
+      if (missing.length === 0 && insecure.length === 0) continue;
+      const line = findLine(content, match.index);
+      const reasons = [];
+      if (missing.length > 0) {
+        reasons.push(`missing flag(s): ${missing.join(", ")}`);
+      }
+      if (insecure.length > 0) {
+        reasons.push(`insecure setting(s): ${insecure.join("; ")}`);
+      }
+      findings.push(
+        makeFinding({
+          checkId: "session-cookie-flags-missing",
+          itemId: "session-management",
+          severity: insecure.length > 0 ? "high" : "medium",
+          message: `Session cookie config at ${rel}:${line} has ${reasons.join(" and ")}. Without httpOnly + secure + sameSite, session state is exposed to XSS, plain-HTTP transit, or cross-site request abuse. Owner must verify other config blocks aren't compensating.`,
+          file: rel,
+          line,
+          evidence: `Cookie config block at ${rel}:${line}. ${reasons.join(". ")}.`
+        })
+      );
+      seenFiles.add(rel);
+      break;
+    }
+    if (seenFiles.has(rel)) continue;
+    for (const { regex, shape } of COOKIE_SET_PATTERNS) {
+      const m = regex.exec(content);
+      if (!m) continue;
+      const block = m[0];
+      const { missing, insecure } = evaluateCookieBlock(block);
+      if (missing.length === 0 && insecure.length === 0) continue;
+      const line = findLine(content, m.index);
+      const reasons = [];
+      if (missing.length > 0) {
+        reasons.push(`missing flag(s): ${missing.join(", ")}`);
+      }
+      if (insecure.length > 0) {
+        reasons.push(`insecure setting(s): ${insecure.join("; ")}`);
+      }
+      findings.push(
+        makeFinding({
+          checkId: "session-cookie-flags-missing",
+          itemId: "session-management",
+          severity: insecure.length > 0 ? "high" : "medium",
+          message: `${shape} at ${rel}:${line} has ${reasons.join(" and ")}. Owner must verify the cookie isn't session-critical or that flags are set in a wrapping framework default.`,
+          file: rel,
+          line,
+          evidence: `${shape} at ${rel}:${line}. ${reasons.join(". ")}.`
+        })
+      );
+      seenFiles.add(rel);
+      break;
+    }
+  }
+  return findings;
+}
+
+// src/checks/unguarded-routes.ts
+import * as path16 from "node:path";
+var RISKY_ROUTE_PATTERNS = [
+  {
+    regex: /\b(app|router)\.(get|post|put|patch|delete)\s*\(\s*["'`]([^"'`]*\/(admin|internal|admin-api|management|console|backoffice)\b[^"'`]*)["'`]/g,
+    shape: "admin/internal route"
+  },
+  {
+    regex: /\b(app|router)\.(delete)\s*\(\s*["'`]([^"'`]+)["'`]/g,
+    shape: "DELETE route"
+  },
+  {
+    regex: /\b(app|router)\.(post|put|patch)\s*\(\s*["'`]([^"'`]*\/(reset|impersonate|seed|wipe|drop|nuke|migrate|admin)[^"'`]*)["'`]/g,
+    shape: "destructive write route"
+  }
+];
+var AUTH_GUARD_REGEX = /\b(requireAuth|requireUser|requireAdmin|requireSession|isAuthenticated|isAdmin|withAuth|protect\s*\(|authenticate\s*\(|authMiddleware|verifySession|getServerSession|currentUser\s*\(|auth\.guard|sessionGuard|verifyToken)\b/;
+var RUNTIME_EXTS6 = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs"
+]);
+async function checkUnguardedRoutes(ctx) {
+  const findings = [];
+  const seenFiles = /* @__PURE__ */ new Set();
+  for (const file of ctx.files) {
+    if (!isTextFile(file)) continue;
+    if (isScanExempt(file.relPath)) continue;
+    if (isLikelyNonRuntimePath(file.relPath)) continue;
+    if (isUiLibraryPrimitive(file.relPath)) continue;
+    const ext = path16.extname(file.relPath).toLowerCase();
+    if (!RUNTIME_EXTS6.has(ext)) continue;
+    const content = await readFileSafe(file);
+    if (!content) continue;
+    const rel = relPosix(file.relPath);
+    if (seenFiles.has(rel)) continue;
+    if (AUTH_GUARD_REGEX.test(content)) continue;
+    for (const { regex, shape } of RISKY_ROUTE_PATTERNS) {
+      regex.lastIndex = 0;
+      const m = regex.exec(content);
+      if (!m) continue;
+      const line = findLine(content, m.index);
+      const routePath = m[3] ?? m[2] ?? "(unknown)";
+      findings.push(
+        makeFinding({
+          checkId: "unguarded-route",
+          itemId: "secure-api",
+          severity: "high",
+          message: `${shape} bound at ${rel}:${line} (path: ${routePath}). No obvious auth-guard middleware (requireAuth / isAdmin / withAuth / getServerSession / similar) was found anywhere in this file. Owner must verify the route is protected by a wrapping middleware, framework convention, or different file \u2014 this scanner cannot trace the middleware chain across files.`,
+          file: rel,
+          line,
+          evidence: `${shape} declared at ${rel}:${line}. No recognized auth-guard symbol present in the file.`
+        })
+      );
+      seenFiles.add(rel);
+      break;
+    }
+  }
+  return findings;
+}
+
+// src/checks/index.ts
+var ALL_CHECKS = [
+  { id: "hardcoded-secrets", run: checkHardcodedSecrets },
+  { id: "config-secret-leaks", run: checkConfigSecretLeaks },
+  { id: "env-committed", run: checkEnvCommitted },
+  { id: "env-example", run: checkEnvExample },
+  { id: "gitignore", run: checkGitignore },
+  { id: "robots-txt", run: checkRobotsTxt },
+  { id: "sitemap-xml", run: checkSitemapXml },
+  { id: "favicon", run: checkFavicon },
+  { id: "llms-txt", run: checkLlmsTxt },
+  { id: "pwa-manifest", run: checkPwaManifest },
+  { id: "security-headers", run: checkSecurityHeaders },
+  { id: "dangerous-patterns", run: checkDangerousPatterns },
+  { id: "language-patterns", run: checkLanguagePatterns },
+  { id: "python-secret-key-env", run: checkPythonSecretKeyEnv },
+  { id: "ruby-secret-key-base-env", run: checkRubySecretKeyBaseEnv },
+  { id: "placeholder-content", run: checkPlaceholderContent },
+  { id: "otp-auth-readiness", run: checkOtpAuthReadiness },
+  { id: "api-spend-cap", run: checkApiSpendCap },
+  { id: "rate-limiting", run: checkRateLimiting },
+  { id: "error-monitoring", run: checkErrorMonitoring },
+  { id: "legal-pages", run: checkLegalPages },
+  { id: "payments-webhook", run: checkPaymentsWebhook },
+  { id: "file-uploads", run: checkFileUploads },
+  { id: "session-cookie", run: checkSessionCookie },
+  { id: "unguarded-routes", run: checkUnguardedRoutes }
+];
+
+// src/items.ts
+var CHECKLIST_ITEMS = {
+  secrets: {
+    id: "secrets",
+    title: "Lock up your API keys and passwords",
+    priority: "critical"
+  },
+  "common-attacks": {
+    id: "common-attacks",
+    title: "Block the most common automated attacks",
+    priority: "critical"
+  },
+  "https-headers": {
+    id: "https-headers",
+    title: "Force HTTPS and add browser-level defenses",
+    priority: "critical"
+  },
+  "dev-prod-data": {
+    id: "dev-prod-data",
+    title: "Keep your test data away from real users",
     priority: "critical"
   },
   "secure-auth": {
@@ -1465,6 +3512,46 @@ var CHECKLIST_ITEMS = {
     title: "Prove auth, OTP, and report access before launch",
     priority: "critical"
   },
+  "api-spend-cap": {
+    id: "api-spend-cap",
+    title: "Cap every AI / API spend before someone bankrupts you",
+    priority: "critical"
+  },
+  "rate-limiting": {
+    id: "rate-limiting",
+    title: "Cap how often someone can hit your app",
+    priority: "high"
+  },
+  "error-monitoring": {
+    id: "error-monitoring",
+    title: "See errors before users tell you about them",
+    priority: "high"
+  },
+  "legal-pages": {
+    id: "legal-pages",
+    title: "Publish Terms of Service and a Privacy Policy",
+    priority: "critical"
+  },
+  payments: {
+    id: "payments",
+    title: "Make sure payments actually work before you charge people",
+    priority: "critical"
+  },
+  "file-uploads": {
+    id: "file-uploads",
+    title: "Lock down uploads and private files",
+    priority: "critical"
+  },
+  "session-management": {
+    id: "session-management",
+    title: "Make sessions feel safe AND convenient",
+    priority: "high"
+  },
+  "secure-api": {
+    id: "secure-api",
+    title: "Lock down your app's behind-the-scenes URLs",
+    priority: "critical"
+  },
   github: {
     id: "github",
     title: "Get your code into GitHub safely",
@@ -1503,13 +3590,13 @@ function permalinkFor(itemId, baseUrl) {
 
 // src/publish.ts
 import { promises as fs2 } from "node:fs";
-import * as path10 from "node:path";
+import * as path17 from "node:path";
 var DEFAULT_BASE_URL = "https://shippingszn.com";
 var PUBLISH_TIMEOUT_MS = 3e3;
 async function detectStack(cwd2) {
   const tags = /* @__PURE__ */ new Set();
   try {
-    const raw = await fs2.readFile(path10.join(cwd2, "package.json"), "utf8");
+    const raw = await fs2.readFile(path17.join(cwd2, "package.json"), "utf8");
     const pkg = JSON.parse(raw);
     const deps = { ...pkg.dependencies ?? {}, ...pkg.devDependencies ?? {} };
     const has = (n) => n in deps;
@@ -1544,7 +3631,7 @@ async function detectStack(cwd2) {
   ];
   for (const [file, tag] of checks) {
     try {
-      await fs2.access(path10.join(cwd2, file));
+      await fs2.access(path17.join(cwd2, file));
       tags.add(tag);
     } catch {
     }
@@ -1595,7 +3682,7 @@ async function publishScan(totals, filesScanned, opts) {
 }
 
 // src/proof.ts
-import * as path11 from "node:path";
+import * as path18 from "node:path";
 var PROOF_TIMEOUT_MS = 5e3;
 var MAX_FINDINGS = 100;
 function shouldUploadProof() {
@@ -1629,7 +3716,7 @@ function buildProofPayload(report, scannerVersion) {
     version: 1,
     source: report.source ?? "cli",
     scanner: "shippingszn",
-    targetName: path11.basename(report.cwd) || "CLI scan",
+    targetName: path18.basename(report.cwd) || "CLI scan",
     score: report.launchReadiness.score,
     label: report.launchReadiness.label,
     decision: report.launchReadiness.decision,
@@ -2129,6 +4216,7 @@ function normalizeLaunchFinding(finding2, source = "manual") {
     message: body,
     fixPrompt: aiBuilderPrompt,
     verify: verificationStep,
+    ...finding2.itemId ? { itemId: finding2.itemId } : {},
     ...location ? { location } : {},
     ...finding2.file ? { file: finding2.file } : {},
     ...finding2.line ? { line: finding2.line } : {},
@@ -2289,8 +4377,8 @@ function parseArgs(argv2) {
     else if (a === "--proof") opts.proof = true;
     else if (a === "--no-color") opts.noColor = true;
     else if (a === "--base-url") opts.baseUrl = argv2[++i] ?? opts.baseUrl;
-    else if (a === "--cwd") opts.cwd = path12.resolve(argv2[++i] ?? opts.cwd);
-    else if (!a.startsWith("-")) opts.cwd = path12.resolve(a);
+    else if (a === "--cwd") opts.cwd = path19.resolve(argv2[++i] ?? opts.cwd);
+    else if (!a.startsWith("-")) opts.cwd = path19.resolve(a);
   }
   return opts;
 }
@@ -2324,12 +4412,6 @@ function color(enabled) {
   };
 }
 var SEVERITY_ORDER = ["critical", "high", "medium", "lower"];
-var SEVERITY_LABEL = {
-  critical: "CRITICAL",
-  high: "HIGH",
-  medium: "MEDIUM",
-  lower: "LOWER"
-};
 function printHelp() {
   process2.stdout.write(
     `shippingszn v${PKG_VERSION}
@@ -2341,20 +4423,21 @@ Usage:
   npx shippingszn [path] [options]
 
 Options:
-  --json                Output a machine-readable JSON report.
+  --json                Output a machine-readable JSON summary.
   --publish             Legacy alias. Anonymous Wall stats publish by default.
   --no-publish          Disable the anonymous Wall post for this run.
-  --base-url <url>      Base URL used to build links back to checklist items.
+  --base-url <url>      Base URL used to build links back to the Launch Fix Kit.
                         (default: ${DEFAULT_BASE_URL2})
   --cwd <path>          Directory to scan. Default: current working directory.
-  --no-color            Disable ANSI colors in the human-readable report.
+  --no-color            Disable ANSI colors in the human-readable summary.
   -h, --help            Show this help.
   -v, --version         Print version.
 
-The scanner only reads files. It never writes, modifies, or deletes. It posts
-anonymous aggregate Wall stats by default: no source code, paths, filenames,
-project names, secrets, handles, emails, or repo URLs.
-Exit code is non-zero if any Critical findings are detected.
+This is the FREE preflight. It tells you launch debt exists. It does NOT tell
+you what's broken or how to fix it \u2014 that's gated behind the $49 Launch Fix Kit
+(unlocks full findings + 46-item workbook + paste-ready AI-builder prompts +
+verification steps + red-flag checks). Read-only on disk. Anonymous aggregate
+counts post to the Wall by default. Exit code non-zero if any critical findings.
 `
   );
 }
@@ -2392,9 +4475,10 @@ async function run() {
     }
   }
   const trimmedBaseUrl = opts.baseUrl.replace(/\/$/, "");
-  const reportUrl = `${trimmedBaseUrl}/report`;
+  const fixKitUrl = `${trimmedBaseUrl}/fix-kit`;
+  const reportUrl = fixKitUrl;
   const proofCreatePath = `${trimmedBaseUrl}/scan`;
-  const proofUploadHint = "Run `npx shippingszn --json > shippingszn-scan.json`, then paste or upload that JSON on shippingszn.com/scan if you want to attach the local scan to a paid report handoff.";
+  const proofUploadHint = "Run `npx shippingszn --proof` if you want to publish a proof URL with this scan.";
   const tracked_aware = applyTrackingAwareSeverity(all, tracked);
   const source = scanSource();
   const enriched = tracked_aware.map((f) => {
@@ -2408,6 +4492,11 @@ async function run() {
         body: f.message,
         message: f.message,
         evidence: f.evidence,
+        whatFailed: f.whatFailed,
+        whyItBlocksLaunch: f.whyItBlocksLaunch,
+        fixInstructions: f.fixInstructions,
+        aiBuilderPrompt: f.aiBuilderPrompt,
+        verificationStep: f.verificationStep,
         file: f.file,
         line: f.line,
         permalink,
@@ -2423,6 +4512,9 @@ async function run() {
       message: normalized.message,
       whatFailed: normalized.whatFailed,
       whyItBlocksLaunch: normalized.whyItBlocksLaunch,
+      fixInstructions: normalized.fixInstructions,
+      aiBuilderPrompt: normalized.aiBuilderPrompt,
+      verificationStep: normalized.verificationStep,
       evidence: normalized.evidence,
       confidence: normalized.confidence,
       ...normalized.location ? { location: normalized.location } : {},
@@ -2439,6 +4531,18 @@ async function run() {
     if (a.itemId !== b.itemId) return a.itemId.localeCompare(b.itemId);
     return a.checkId.localeCompare(b.checkId);
   });
+  const publicFindings = enriched.map((f) => {
+    const {
+      whatFailed: _whatFailed,
+      whyItBlocksLaunch: _whyItBlocksLaunch,
+      fixInstructions: _fixInstructions,
+      aiBuilderPrompt: _aiBuilderPrompt,
+      verificationStep: _verificationStep,
+      body: _body,
+      ...publicFinding
+    } = f;
+    return publicFinding;
+  });
   const totals = {
     critical: 0,
     high: 0,
@@ -2475,14 +4579,20 @@ async function run() {
     filesScanned: files.length,
     totals,
     launchReadiness,
-    findings: enriched
+    findings: publicFindings
   };
   let proofResult = { status: "skipped" };
   if (opts.proof) {
-    proofResult = await uploadProof(report, {
-      baseUrl: opts.baseUrl,
-      scannerVersion: PKG_VERSION
-    });
+    proofResult = await uploadProof(
+      {
+        ...report,
+        findings: enriched
+      },
+      {
+        baseUrl: opts.baseUrl,
+        scannerVersion: PKG_VERSION
+      }
+    );
     if (proofResult.status === "uploaded") {
       report.launchReadiness.proofUrl = proofResult.proofUrl;
       report.launchReadiness.proofResultId = proofResult.id;
@@ -2511,149 +4621,129 @@ async function run() {
     }
   } catch {
   }
+  const automatedAreas = CHECKLIST.filter(
+    (item) => item.cliCoverage === "automated"
+  ).length;
+  const ownerVerifyAreas = CHECKLIST.filter(
+    (item) => item.cliCoverage === "manual_only"
+  ).length;
+  const band = totals.critical > 0 ? "no_go" : totals.high > 0 ? "fix_first" : launchReadiness.score >= 90 ? "launchable" : launchReadiness.score >= 70 ? "verify_before_launch" : "fix_first";
+  const bandLabel = {
+    no_go: "NO-GO",
+    fix_first: "FIX FIRST",
+    verify_before_launch: "VERIFY BEFORE LAUNCH",
+    launchable: "LAUNCHABLE"
+  }[band];
+  const wallPublishedViaProof = proofResult.status === "uploaded" && !!proofResult.wallUrl;
+  const wallStatus = wallPublishedViaProof ? "published" : proofResult.status === "uploaded" && proofResult.wallPublishError ? "failed" : publishResult;
+  const wallUrl = wallPublishedViaProof ? proofResult.wallUrl : publishResult === "published" ? `${trimmedBaseUrl}/wall` : void 0;
+  const wallError = proofResult.wallPublishError;
   if (opts.json) {
-    process2.stdout.write(JSON.stringify(report, null, 2) + "\n");
+    const panicSummary = {
+      score: launchReadiness.score,
+      band,
+      counts: { ...totals },
+      filesScanned: files.length,
+      coverage: {
+        automatedAreas,
+        ownerVerifyAreas,
+        totalAreas: CHECKLIST.length
+      },
+      scannerVersion: PKG_VERSION,
+      detailsLocked: true,
+      unlockUrl: fixKitUrl,
+      wall: {
+        status: wallStatus,
+        ...wallUrl ? { url: wallUrl } : {},
+        ...wallError ? { error: wallError } : {}
+      },
+      proof: {
+        status: proofResult.status,
+        ...proofResult.status === "uploaded" ? {
+          url: proofResult.proofUrl,
+          resultId: proofResult.id
+        } : {},
+        ...proofResult.status === "failed" && proofResult.error ? { error: proofResult.error } : {}
+      }
+    };
+    process2.stdout.write(JSON.stringify(panicSummary, null, 2) + "\n");
     return totals.critical > 0 ? 1 : 0;
   }
-  const sevColor = (s) => {
-    if (s === "critical") return c.red;
-    if (s === "high") return c.yellow;
-    if (s === "medium") return c.blue;
-    return c.gray;
-  };
-  const safe = (s) => s.replace(/[\x00-\x1f\x7f]/g, "?");
+  const bandColor = band === "no_go" ? c.red : band === "fix_first" ? c.yellow : band === "verify_before_launch" ? c.blue : c.green;
   process2.stdout.write(
     `
 ${c.bold("shippingszn")} ${c.dim(`v${PKG_VERSION}`)}
 `
   );
-  process2.stdout.write(
-    c.dim(`Scanned ${files.length} files in ${opts.cwd}
+  process2.stdout.write(c.dim(`Scanned ${files.length} files.
 
-`)
-  );
+`));
   process2.stdout.write(
-    `${c.bold("Launch Readiness Score:")} ${launchReadiness.score}/100 ${c.dim(`(${launchReadiness.label})`)}
-`
-  );
-  process2.stdout.write(
-    `${c.bold("Scope:")} ${safe(launchReadiness.coverageSummary)}
+    `${c.bold("Launch Debt Score:")} ${launchReadiness.score}/100  \u2014  ${bandColor(c.bold(bandLabel))}
+
 `
   );
+  process2.stdout.write(`${c.bold("Findings detected:")}
+`);
+  process2.stdout.write(`  ${c.red(`${totals.critical} critical`)}
+`);
+  process2.stdout.write(`  ${c.yellow(`${totals.high} high`)}
+`);
+  process2.stdout.write(`  ${c.blue(`${totals.medium} medium`)}
+`);
+  process2.stdout.write(`  ${c.gray(`${totals.lower} lower`)}
+
+`);
+  process2.stdout.write(`${c.bold("Coverage:")}
+`);
   process2.stdout.write(
-    `${c.bold("Top next step:")} ${safe(launchReadiness.topNextStep)}
+    c.dim(
+      `  ${automatedAreas} of ${CHECKLIST.length} launch-readiness areas checked by the scanner
 `
+    )
   );
   process2.stdout.write(
-    `${c.bold("Action plan:")} ${c.dim("Exact AI-builder prompts and verification steps are in the paid report.")}
-`
+    c.dim(`  ${ownerVerifyAreas} require owner verification
+
+`)
   );
-  if (launchReadiness.reportUrl) {
-    process2.stdout.write(
-      `${c.bold("Need a written launch decision?")} ${c.dim(`Get the $49 report: ${launchReadiness.reportUrl}`)}
-`
-    );
-  }
-  if (proofResult.status === "uploaded") {
-    process2.stdout.write(
-      `${c.bold("Proof URL:")} ${c.dim(proofResult.proofUrl ?? "")}
-`
-    );
-    process2.stdout.write(
-      `${c.bold("Report URL:")} ${c.dim(proofResult.reportUrl ?? "")}
-`
-    );
-    if (proofResult.wallUrl) {
-      process2.stdout.write(
-        `${c.bold("Wall URL:")} ${c.dim(proofResult.wallUrl)}
-`
-      );
-    }
+  if (totals.critical + totals.high + totals.medium + totals.lower > 0) {
     process2.stdout.write(
-      `${c.bold("Badge Markdown:")} ${c.dim(proofResult.badgeMarkdown ?? "")}
-`
-    );
-    if (proofResult.wallPublishError) {
-      process2.stdout.write(
-        `${c.bold("Wall publish failed:")} ${c.dim(proofResult.wallPublishError)}
-`
-      );
-    }
-  } else if (proofResult.status === "failed") {
-    process2.stdout.write(
-      `${c.bold("Proof upload failed:")} ${c.dim(proofResult.error ?? "Unknown upload error.")}
-`
+      c.bold(
+        "Unlock the Launch Fix Kit to see exactly what's broken and how to fix it:\n"
+      )
     );
+    process2.stdout.write(`  ${c.cyan(fixKitUrl)}
+
+`);
   } else {
-    const wallLine = publishResult === "published" ? `Posted anonymous scan stats to ${opts.baseUrl.replace(/\/$/, "")}/wall.` : opts.publish ? "Anonymous Wall stats post by default. If the network is blocked, the local scan still finishes." : "Private local run: Wall publish disabled.";
-    process2.stdout.write(
-      `${c.bold("Wall signal:")} ${c.dim(wallLine)}
-`
-    );
-  }
-  process2.stdout.write("\n");
-  if (enriched.length === 0) {
     process2.stdout.write(
       c.green(
-        "No findings. The scanner did not catch obvious launch blockers in this pass.\n\n"
+        "No findings detected. The Launch Fix Kit covers the 27 owner-verify areas the scanner can't reach:\n"
       )
     );
-    if (publishResult === "published") {
-      process2.stdout.write(
-        c.dim(
-          `Posted an anonymous summary to the Wall: ${opts.baseUrl}/wall
-`
-        )
-      );
-    }
-    return 0;
+    process2.stdout.write(`  ${c.cyan(fixKitUrl)}
+
+`);
   }
-  for (const sev of SEVERITY_ORDER) {
-    const group = enriched.filter((f) => f.severity === sev);
-    if (group.length === 0) continue;
+  if (proofResult.status === "uploaded" && proofResult.proofUrl) {
+    process2.stdout.write(c.dim(`Proof URL: ${proofResult.proofUrl}
+`));
+  } else if (proofResult.status === "failed") {
     process2.stdout.write(
-      `${sevColor(sev)(c.bold(`${SEVERITY_LABEL[sev]} (${group.length})`))}
-`
+      c.dim(`(Proof upload failed: ${proofResult.error ?? "unknown"})
+`)
     );
-    for (const f of group) {
-      const loc = f.file ? ` ${c.dim(`\u2014 ${safe(f.file)}${f.line ? `:${f.line}` : ""}`)}` : "";
-      process2.stdout.write(`  ${c.bold("\u2022")} ${safe(f.message)}${loc}
-`);
-      if (f.evidence) {
-        process2.stdout.write(`    ${c.dim(`evidence: ${safe(f.evidence)}`)}
-`);
-      }
-      process2.stdout.write(
-        `    ${c.cyan(`\u2192 ${safe(f.itemTitle)}`)} ${c.dim(f.permalink)}
-`
-      );
-    }
-    process2.stdout.write("\n");
   }
-  process2.stdout.write(
-    `${c.bold("Summary:")} ${c.red(`${totals.critical} critical`)}, ${c.yellow(`${totals.high} high`)}, ${c.blue(`${totals.medium} medium`)}, ${c.gray(`${totals.lower} lower`)}
-`
-  );
   if (publishResult === "published") {
     process2.stdout.write(
-      c.dim(
-        `
-Posted an anonymous summary to the Wall: ${opts.baseUrl}/wall
-`
-      )
+      c.dim(`(Anonymous score posted to ${trimmedBaseUrl}/wall)
+`)
     );
   }
   if (totals.critical > 0) {
-    process2.stdout.write(
-      c.red("\nCritical findings detected. Exiting with code 1.\n")
-    );
     return 1;
   }
-  process2.stdout.write(
-    c.dim(
-      "\nNo critical findings. Open the linked checklist items to dig deeper.\n"
-    )
-  );
   return 0;
 }
 run().then(