PreLaunchGate v0.2.2 — Pre-Launch Self-Check Auditor for Vibe-Coded & Supabase Apps

DISCLAIMER (v2026-10-23.v2): This tool is an automated heuristic pre-launch self-check, NOT a penetration test, independent security acceptance, or launch approval. SELFCHECK_NO_ALERT (PASS) does NOT guarantee the absence of vulnerabilities or readiness to launch. Use strictly on assets you own or have explicit written authorization to test. Remediation SQL and config snippets are examples only—always verify your actual database schema and column names (e.g., user_id may not exist) before applying, as an incorrect policy can break application functionality or leave authorization gaps. This tool does not replace independent security acceptance (such as Security Bot Stage 4 review).

【免责声明 v2026-10-23.v2】：本工具为自动化启发式上线前自助体检，非渗透测试、非独立安全验收或上线放行批准。SELFCHECK_NO_ALERT（PASS）不代表可安全上线或无漏洞；仅限对自有或已获明确书面授权的资产使用；修复 SQL 与配置仅为示例，执行前须核对真实表结构与列名（如 user_id 未必存在），错误策略可能导致业务中断或权限缺口；本工具不能替代独立安全验收。

1. What It Does

Shipping with Cursor, Lovable, Bolt.new, v0, Replit, Next.js, and Supabase is fast—but accidental .env exposure, bundled service_role keys, or disabled Supabase Row Level Security (RLS) are common pre-launch oversights.

PreLaunchGate runs a 30-second external heuristic self-check against your public deployment URL and outputs both a structured JSON report (OUTPUT / REPORT.json) and a human-readable Markdown report (REPORT.md):

1. Frontend Bundle & Secret Leak Self-Check:
   • Scans HTML and up to 11 referenced .js bundles (and checks for exposed .js.map source maps and /.env).
   • High-confidence detection (confidence: "HIGH") for leaked Supabase service_role JWTs, OpenAI sk-... keys, Stripe sk_live_... / rk_live_... / whsec_... keys, AWS AKIA... keys, PEM private keys, GitHub ghp_ / github_pat_ tokens, Google AIza... API keys, and Slack xox[baprs]-... tokens.
   • Calibrated low-confidence alerts (BUNDLE-ENV-VAR-REFERENCE, severity: "MEDIUM", confidence: "LOW") when frontend env var names reference secrets without a confirmed plaintext key match.
2. Safe Zero-Row-Body Supabase RLS Count Probe:
   • Auto-detects https://<project_ref>.supabase.co and the public anon key from your frontend bundle (or accepts them via explicit input).
   • Probes PostgREST using HEAD (with GET fallback) + ?select= + Range: 0-0 + Prefer: count=exact, return=minimal and max_bytes=0.
   • Zero database row contents are ever read, parsed, logged, or stored—only the HTTP Content-Range total row count is inspected.
3. Safe Example Remediation Templates:
   • Every SQL template starts with -- EXAMPLE ONLY: verify actual column names... and validates identifiers against ^[A-Za-z_][A-Za-z0-9_]{0,62}$.
   • Only emits an active CREATE POLICY ... USING (auth.uid() = user_id) example if user_id is explicitly verified in your OpenAPI table schema; otherwise provides a commented-out template and official Supabase RLS documentation links.
4. Full-Path SSRF & DNS Rebinding Protection:
   • Validates the initial URL, every HTTP redirect hop (301/302/303/307/308), script/sourcemap URLs, and Supabase URLs.
   • Blocks non-HTTP/HTTPS schemes, RFC1918 private networks, loopback, link-local, cloud metadata endpoints (169.254.169.254, 100.100.100.200, fd00:ec2::253, metadata.google.internal), IPv4-mapped/compatible/6to4/Teredo/NAT64 IPv6 addresses, and octal/hex/decimal IP encodings, and pins resolved IPs at socket connection time.

2. Apify Pay-Per-Event (PPE) Pricing (Max $0.15 / Scan)

Aligned with .actor/pay_per_event.json:

• scan-url ($0.03): Charged once when the target web app URL is reachable and scanned (never charged if unreachable or blocked by SSRF guard).
• rls-table-probe ($0.02): Charged once when a Supabase RLS safe count probe is executed.
• remediation-patch-generated ($0.005 per deduplicated finding, capped at 20 findings = max $0.10): Total scan cost is strictly capped at $0.15.

3. CLI Usage (Zero External Dependencies)

python3 src/prelaunch_gate.py \
  --url https://your-app.vercel.app \
  --confirm-owned \
  --output report.json \
  --markdown-output report.md

--allow-private（仅本机调试）：CLI 显式传入时可跟随环回/私网目标，供本地靶机自测；禁止用于探测非自有私网。云端 Apify Actor 强制 allow_private=False，不可通过输入开启。Metadata / 链路本地地址即便开了该开关仍会被拦截。

--allow-private (local debugging only): When passed explicitly on the CLI, loopback/private targets may be followed for local mock targets. Do not use it to probe private networks you do not own. The Apify Actor always forces allow_private=False. Cloud metadata and link-local hosts remain blocked even with this flag.