LaunchGuard

LaunchGuard V1 is a local launch-readiness scanner for AI-built SaaS projects. It reads a local project folder, checks for obvious launch risks, and renders a plain-English report with fix prompts.

Run Locally

cd web
npm run dev

If this Codex shell does not have npm on PATH, use the local npm bootstrap created during setup:

cd web
PATH="$HOME/.cache/codex-local-npm/bin:$HOME/.cache/codex-runtimes/codex-primary-runtime/dependencies/node/bin:$PATH" npm run dev

Then open http://127.0.0.1:3000.

Hosted Scan Inputs

Hosted requests scan public GitHub repository URLs, such as https://github.com/owner/repo. LaunchGuard fetches a bounded source file list through GitHub and runs the same checks against those fetched files.

Real project-path scanning is intentionally localhost-only. A hosted request cannot scan /Users/..., repo folders, or server paths.

Deploy

Deploy the Next.js app from the web/ directory. On Vercel, set the project root directory to web; the existing build and start scripts are enough for a standard Next.js deployment.

Current production deployment:

https://launchguard-v1.vercel.app

Before deploying, run:

cd web
npm run eval:scanner
npm run lint
npm run build

Verify The Scanner

Run the fixture eval whenever scanner checks change:

cd web
npm run eval:scanner

The eval scans fixtures/broken-next-app and fails if the expected V1 findings disappear. It is a small safety net for future scanner improvements, not a full test suite yet.

V1 Flow

1. Paste a public GitHub repository URL for hosted-safe repo scanning.
2. Or, on localhost, enter a local project path.
3. The frontend posts the target to /api/scan.
4. The API route either fetches bounded public GitHub files or, on localhost only, runs server-only filesystem scanning.
5. The scanner returns a typed ScanReport.
6. The UI groups findings by severity and shows copyable fix prompts.
7. The user can download a standalone visual HTML report for saving or sharing.

Key Files

• web/src/lib/scanner/types.ts: report and finding TypeScript contracts.
• web/src/lib/scanner/fileWalker.ts: safe-ish local file collection with size limits and ignored folders.
• web/src/lib/scanner/githubRepo.ts: hosted-safe public GitHub repo collector.
• web/src/lib/report/htmlReport.ts: standalone HTML report generator.
• web/src/lib/scanner/checks.ts: V1 heuristic checks for secrets, Supabase, auth, Stripe webhooks, and AI cost controls.
• web/src/app/api/scan/route.ts: localhost-only scan API route.
• web/src/app/page.tsx: interactive scanner UI.
• web/scripts/eval-scanner.ts: known-bad fixture eval for scanner regressions.
• fixtures/broken-next-app: known-bad fixture used as the first scanner eval.
• docs/launchguard-v1-report.png: browser-verified screenshot proof.
• docs/launchguard-public-demo.png: production-verified public demo proof.
• docs/launchguard-public-demo-mobile.png: mobile public demo proof.
• web/public/launchguard-risk-map.png: hero visual used by the public demo.

V1 Safety Note

LaunchGuard V1 is intentionally local-only. A hosted version should not expose an API route that reads arbitrary filesystem paths. Build hosted scanning through a sandboxed CLI, uploaded archive, or isolated worker flow.

Dependency Audit Note

The fresh Next.js scaffold currently reports a moderate postcss advisory through next@16.2.7. npm audit fix --dry-run says the only available fix is npm audit fix --force, which would install next@9.3.3 and break the App Router scaffold. Do not force-fix this without deliberately choosing a compatible Next.js version.