skills.rest
BryanPinheiro77
BryanPinheiro77COMMUNITY
Explore all skills by this author →
GitHub

ship-gate

Audits codebases for security, database, and deployment issues before production release.

2|Updated Mar 24, 2026
Search Tags:#code quality#static analysis#supabase#security scan#release readiness#deployment checklist#pre-production audit
One-click install
npx skills add https://github.com/BryanPinheiro77/FinanceBot-BackEnd --skill ship-gate-bryanpinheiro77
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ship-gate
Source: https://github.com/BryanPinheiro77/FinanceBot-BackEnd/tree/main/.agents/skills/ship-gate
Command: npx skills add https://github.com/BryanPinheiro77/FinanceBot-BackEnd --skill ship-gate-bryanpinheiro77

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Shipping code to production without a systematic review leads to exposed secrets, missing authentication, SQL injection vectors, and untested rollback plans. This Skill runs a structured pre-production audit across 8 categories and blocks deployment until critical issues are resolved. ## Core Features & Use Cases - Automated Multi-Category Scanning: Runs 40+ checks across Security, Database, Deployment, Code Quality, AI/LLM, Dependencies, Frontend, and Observability using grep patterns and a Python CLI scanner. - Stack-Aware Detection: Identifies frameworks (Next.js, React, Django, FastAPI), databases (Supabase, PostgreSQL, MongoDB), and deploy targets (Vercel, Docker, Fly.io) to skip irrelevant checks. - Severity-Based Verdicts: Classifies findings as CRITICAL, HIGH, or ADVISORY and outputs a clear verdict: DO NOT SHIP, SHIP WITH CAUTION, or CLEAR TO SHIP. - Use Case: Before deploying a Next.js + Supabase app, run the audit to catch a service_role key leaked in client code and missing RLS policies, then re-run after fixes to confirm clearance. ## Quick Start Ask the AI to run the ship gate audit on this project before deploying to production.

Frequently Asked Questions about ship-gate

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a pre-production security audit on my codebase?▼

Run the ship gate audit, which scans your project across 8 categories including security, database, and deployment. It detects your stack automatically, runs grep-based checks for issues like exposed API keys and missing CSRF protection, then reports a ship or no-ship verdict.

What does a pre-launch checklist for a Next.js app include?▼

A pre-launch audit covers secrets in frontend code, authentication on routes, CORS configuration, rate limiting, error boundaries, console.log removal, and meta tags. Stack detection identifies Next.js and applies relevant checks like error.tsx presence and metadata exports.

Does the audit work with Python or Go projects?▼

Yes, the audit detects Python projects via requirements.txt or pyproject.toml and Go via go.mod. Framework-specific checks apply for Django, Flask, and FastAPI, while stack-agnostic checks like SQL injection patterns and secret scanning run on any codebase.

Can the audit check Supabase row level security?▼

Yes, Supabase-specific checks verify RLS is enabled on all tables by scanning migration files for CREATE TABLE without corresponding ENABLE ROW LEVEL SECURITY statements. It also detects service_role keys leaked into client-side code.

What are the limitations of an automated pre-deploy scan?▼

The audit only reports issues and does not fix them, set up CI/CD pipelines, or provision infrastructure. Some checks like backup restore testing and staging validation require manual confirmation since they cannot be verified by static code analysis.

Related Skills

Explore More Software Engineering Skills→
curiositechcuriositech
181

launch-readiness-auditor

Assess software projects for production readiness and identify launch blockers.

Official
Advanced
trailofbitstrailofbits
6.5k

insecure-defaults

Detect insecure default configurations with hardcoded secrets and weak authentication.

Official
Intermediate
adamatdevopsadamatdevops
1

differential-review

Analyze code changes for security regressions and generate markdown reports.

Community
Advanced
rnavarychrnavarych
14

role-aqa:security-testing

Your response is missing. Please try again.

Community
Advanced