Bouncer - a skill that decides whether a prototype is ready for real users

[punitsnaik]

I kept asking Claude "is this app ready to launch?" and getting a thoughtful,
well-organised answer that was partly guessed. So I built the skill I wanted.

Bouncer works the door for prototype and AI-built apps: it inspects the codebase
and gives one of two answers - YOU'RE IN or NOT TONIGHT - 3 reasons.

https://github.com/punitsnaik/Bouncer

What it looks at. Not a generic SRE checklist - the failures that are near-universal
in apps built with Lovable, Bolt, v0, or Claude:

• Supabase / Firebase with row-level security never switched on
• Secrets behind NEXT_PUBLIC_ / VITE_ - that prefix ships them to every visitor
• .env committed to git
• API routes with no auth check, because the UI hid the button
• IDOR - change the id in the URL, get someone else's record
• Unbounded queries that work at 50 rows and die at 10,000

Plus stack-specific passes for Supabase, Firebase, Next.js, Vercel, Stripe, Clerk and
Prisma, because "secure your database" is useless advice to someone who didn't choose
their database.

Two design decisions I'd be interested in feedback on:

The deterministic part is a shell script. scripts/bouncer.sh is 13 grep-based checks,
no dependencies, exits 1 on a blocker. The model reads the output and does the judgement

• what's a real finding, what's a fixture, what matters for this app. Splitting it that
  way meant I could write regression tests for the half that should never drift. 23
  assertions across 4 fixture apps, including a deliberately clean one, because a scanner
  that flags everything is as useless as one that flags nothing.

It refuses to report a pass it isn't sure of. Every run opens with a coverage count -
files found vs files readable. If anything was unreadable it exits 1 and says
INCOMPLETE SCAN - do not read this as a pass. This came out of a real run on a
Google Drive folder where online-only files are placeholders that grep silently can't
read. It examined a fraction of the app and printed a clean result. "I saw nothing" and
"I couldn't see" have to be different sentences, or the tool is worse than no tool.

MIT, no telemetry, nothing leaves the machine. The .skill is attached to the release
if you want to try it in one click.

Happy to take issues or PRs - new checks should arrive with a fixture that fails without
them and doesn't fire on the clean app.