# PreLaunchGate — Supabase RLS Pre-Check for Vibe Apps (`vicyi/prelaunch-gate`) Actor

Supabase RLS pre-check for vibe-coded Next.js/Cursor/Lovable/Bolt apps. From $0.03/scan (PPE): .env & service_role/OpenAI/Stripe leaks + anonymous RLS zero-row probes. Heuristic self-check only—NOT a penetration test or launch approval.

- **URL**: https://apify.com/vicyi/prelaunch-gate.md
- **Developed by:** [Yi Vic](https://apify.com/vicyi) (community)
- **Categories:** Developer tools, AI, Automation
- **Security:** Limited permissions
- **Stats:** 2 total users, 1 monthly users, 85.7% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $30.00 / 1,000 base web app & bundle security scans

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## PreLaunchGate v0.2.2 — Pre-Launch Self-Check Auditor for Vibe-Coded & Supabase Apps

> **DISCLAIMER (`v2026-10-23.v2`)**: This tool is an **automated heuristic pre-launch self-check**, **NOT** a penetration test, independent security acceptance, or launch approval. `SELFCHECK_NO_ALERT` (`PASS`) does **NOT** guarantee the absence of vulnerabilities or readiness to launch. Use strictly on assets you own or have explicit written authorization to test. Remediation SQL and config snippets are **examples only**—always verify your actual database schema and column names (e.g., `user_id` may not exist) before applying, as an incorrect policy can break application functionality or leave authorization gaps. This tool does **not** replace independent security acceptance (such as Security Bot Stage 4 review).
>
> **【免责声明 `v2026-10-23.v2`】**：本工具为**自动化启发式上线前自助体检**，**非**渗透测试、非独立安全验收或上线放行批准。`SELFCHECK_NO_ALERT`（`PASS`）**不代表**可安全上线或无漏洞；仅限对自有或已获明确书面授权的资产使用；修复 SQL 与配置仅为示例，执行前须核对真实表结构与列名（如 `user_id` 未必存在），错误策略可能导致业务中断或权限缺口；本工具不能替代独立安全验收。

### 1. What It Does

Shipping with **Cursor, Lovable, Bolt.new, v0, Replit, Next.js, and Supabase** is fast—but accidental `.env` exposure, bundled `service_role` keys, or disabled Supabase Row Level Security (RLS) are common pre-launch oversights.

**PreLaunchGate** runs a 30-second external heuristic self-check against your public deployment URL and outputs both a structured JSON report (`OUTPUT` / `REPORT.json`) and a human-readable Markdown report (`REPORT.md`):

1. **Frontend Bundle & Secret Leak Self-Check**:
   - Scans HTML and up to 11 referenced `.js` bundles (and checks for exposed `.js.map` source maps and `/.env`).
   - High-confidence detection (`confidence: "HIGH"`) for leaked Supabase `service_role` JWTs, OpenAI `sk-...` keys, Stripe `sk_live_...` / `rk_live_...` / `whsec_...` keys, AWS `AKIA...` keys, PEM private keys, GitHub `ghp_` / `github_pat_` tokens, Google `AIza...` API keys, and Slack `xox[baprs]-...` tokens.
   - Calibrated low-confidence alerts (`BUNDLE-ENV-VAR-REFERENCE`, `severity: "MEDIUM"`, `confidence: "LOW"`) when frontend env var names reference secrets without a confirmed plaintext key match.
2. **Safe Zero-Row-Body Supabase RLS Count Probe**:
   - Auto-detects `https://<project_ref>.supabase.co` and the public `anon` key from your frontend bundle (or accepts them via explicit input).
   - Probes PostgREST using `HEAD` (with `GET` fallback) + `?select=` + `Range: 0-0` + `Prefer: count=exact, return=minimal` and `max_bytes=0`.
   - **Zero database row contents are ever read, parsed, logged, or stored**—only the HTTP `Content-Range` total row count is inspected.
3. **Safe Example Remediation Templates**:
   - Every SQL template starts with `-- EXAMPLE ONLY: verify actual column names...` and validates identifiers against `^[A-Za-z_][A-Za-z0-9_]{0,62}$`.
   - Only emits an active `CREATE POLICY ... USING (auth.uid() = user_id)` example if `user_id` is explicitly verified in your OpenAPI table schema; otherwise provides a commented-out template and official Supabase RLS documentation links.
4. **Full-Path SSRF & DNS Rebinding Protection**:
   - Validates the initial URL, every HTTP redirect hop (`301/302/303/307/308`), script/sourcemap URLs, and Supabase URLs.
   - Blocks non-HTTP/HTTPS schemes, RFC1918 private networks, loopback, link-local, cloud metadata endpoints (`169.254.169.254`, `100.100.100.200`, `fd00:ec2::253`, `metadata.google.internal`), IPv4-mapped/compatible/6to4/Teredo/NAT64 IPv6 addresses, and octal/hex/decimal IP encodings, and pins resolved IPs at socket connection time.

### 2. Apify Pay-Per-Event (PPE) Pricing (Max $0.15 / Scan)

Aligned with `.actor/pay_per_event.json`:

- **`scan-url`** (`$0.03`): Charged once when the target web app URL is reachable and scanned (never charged if unreachable or blocked by SSRF guard).
- **`rls-table-probe`** (`$0.02`): Charged once when a Supabase RLS safe count probe is executed.
- **`remediation-patch-generated`** (`$0.005` per deduplicated finding, **capped at 20 findings = max `$0.10`**): Total scan cost is strictly capped at **`$0.15`**.

### 3. CLI Usage (Zero External Dependencies)

```bash
python3 src/prelaunch_gate.py \
  --url https://your-app.vercel.app \
  --confirm-owned \
  --output report.json \
  --markdown-output report.md
```

> **`--allow-private`（仅本机调试）**：CLI 显式传入时可跟随环回/私网目标，供本地靶机自测；**禁止**用于探测非自有私网。云端 Apify Actor 强制 `allow_private=False`，不可通过输入开启。Metadata / 链路本地地址即便开了该开关仍会被拦截。
>
> **`--allow-private` (local debugging only)**: When passed explicitly on the CLI, loopback/private targets may be followed for local mock targets. Do **not** use it to probe private networks you do not own. The Apify Actor always forces `allow_private=False`. Cloud metadata and link-local hosts remain blocked even with this flag.

# Actor input Schema

## `targetUrl` (type: `string`):

Public URL of the web application you own or have explicit written authorization to self-check (e.g., https://my-saas-app.vercel.app). Private/internal/metadata IPs are strictly blocked.

## `authorizationConfirmed` (type: `boolean`):

Required legal & safety gate: You must confirm ownership/written authorization and acknowledge this is an automated heuristic self-check (NOT a penetration test or launch approval; SELFCHECK_NO_ALERT does not guarantee zero vulnerabilities).

## `supabaseUrl` (type: `string`):

Optional explicit Supabase URL (https://<project-ref>.supabase.co) if not automatically detected in JS bundles.

## `supabaseAnonKey` (type: `string`):

Optional Supabase public anon JWT to perform safe zero-row-body (Range: 0-0, Prefer: count=exact, return=minimal) RLS table exposure checks.

## Actor input object example

```json
{
  "targetUrl": "https://example.com",
  "authorizationConfirmed": true
}
```

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "targetUrl": "https://example.com",
    "authorizationConfirmed": true
};

// Run the Actor and wait for it to finish
const run = await client.actor("vicyi/prelaunch-gate").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "targetUrl": "https://example.com",
    "authorizationConfirmed": True,
}

# Run the Actor and wait for it to finish
run = client.actor("vicyi/prelaunch-gate").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "targetUrl": "https://example.com",
  "authorizationConfirmed": true
}' |
apify call vicyi/prelaunch-gate --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,vicyi/prelaunch-gate"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/tlNTsxerjNNweYrFi/builds/fe7aZUK7FzDfYFhvz/openapi.json