project_scan
Scans your project for the mistakes AI-written apps make: SQL built from strings, secrets in code, routes without an auth check, dependencies with known flaws.
Security and quality scan · Reads only
Scan the preview for the mistakes AI-written apps make: SQL built from strings, HTML injected from variables, secrets in code or in files browsers download, API routes that change data without an auth check, dependencies with known vulnerabilities (lockfiles against OSV), keys, passwords and salts written into the code (data.secrets_in_code: file, line, kind, whether you can generate it, the environment variable to read; never the value; ask the user before moving them to the secrets tool), markup that fights a change in the project's own HTML and CSS files (duplicate_markup: the same id or section twice; inline_important: !important in inline styles and stylesheets; conflicting_rules: a selector setting the same property to different values in two places), and an accessibility pass (contrast, labels, alt text, landmarks) on pages of the running app. Every finding has the file and line and the fix to make. Run it before publishing and after adding sign-in, payments or forms. pages: paths to check for accessibility (default /).
For your AI: this page as Markdown · llms.txt