Launch checks for AI-built apps

From demo to production

One command finds what breaks before launch and hands the fix to your agent.

Try VibeRaven See how it works
  • Runs on your machine
  • No account or API key
  • Fixes go to Claude Code, Codex or Gemini CLI

BlockerNo RLS on public.posts

Fixedby Claude Code, +9 lines

Re-checkedReadiness 75 → 95

Viberaven/posts-app/main · v0.4.1 1 blocker
repo
northfield/posts-app

DetectedReady

auth
Clerk

Callbacks matchReady

web
posts-app.vercel.app

2 env vars missingReview

database
public.posts

No RLS policyNot ready

payments
/api/stripe/webhook

Signature checkedReady

Services
cache
email
monitoring
Sentry

Not wired inReview

Last check just now · on this computer

Scan Fix Re-check Launch
Fig. 1The Studio checking a sample project · illustrative example
01Readsposts-app · 7 services · 0.8s

It reads the stack you already ship

Config, env files, migrations and routes, straight from your repo. Nothing to connect and nothing uploaded. Open a row to see what it checks there.

    02Finds1 critical · 3 to review

    It finds what will break

    Anyone holding the anon key can read and change every row in public.posts

    Criticalrls_disabledsupabase/migrations/0001_posts.sql:1

    supabase/migrations/0001_posts.sqlSupabase
    1create table public.posts (
    2 id uuid primary key,
    3 user_id uuid references auth.users,
    4 body text
    5);
    +alter table posts enable row level security;
    +create policy "owner writes" on posts using (auth.uid() = user_id);
    Fig. 2The flagged line, and the two lines that fix it
    1. 02Review

      The Stripe webhook never checks the signature, so anyone can post a fake paid event.

      unverified_stripe_webhook · app/api/stripe/webhook/route.ts:3
    2. 03Review

      Your code reads two env vars the template doesn’t list, so a fresh deploy ships without them.

      env_var_drift · .env.example
    3. 04Review

      Errors in production reach no one, because monitoring isn’t wired in.

      missing_monitoring · app/
    03Hands offprompt ready · 1 file · 2 lines

    It hands the fix to your agent

    Pick the agent you use. This is the prompt it gets: the file, the line and the change.

    Promptto Claude Code

    public.posts has no row level security supabase/migrations/0001_posts.sql:1. Enable it in a new migration with owner-only policies, then run npx -y viberaven check and stop when it passes.

    Fig. 3The prompt your agent gets, and what it did with it
    04Checks againrun 43 · re-check

    Then it checks again

    75/100

    1 blocker · No row level security on public.posts

    • Row level security on every table
    • Stripe webhook verifies the signature
    • Service role key out of client code
    • Secret files gitignored
    • No blockers in the code

    Free Supabase RLS checker

    Paste your migration SQL or drop the .sql files. It lists public tables without row level security, using (true) policies and security definer functions the anon key can call, with the file and line. It runs in your browser and sends nothing.

    Check your migrations

    Common questions

    All launch guides

    Run it before your users do

    Find what breaks, hand the fix to your agent, and launch knowing it holds.

    Free to start. Open the app and check your first project.

    Try VibeRaven free Sign in

    No account, no API key, and nothing leaves your machine.

    Prefer the terminal? $ npx -y viberavenCopied