LaunchVet
Your app runs. Is it ready to launch?
LaunchVet audits your vibe-coded app for security, legal and payments problems, inside Claude Code, on your own repo. You get a ranked report and a copy-paste fix prompt for every finding.
Runs in your own Claude Code session. No server of ours, no signup, nothing uploaded to us. 30-day refund, no questions.
Verdict: NOT READY TO LAUNCH: fix the critical findings first.
7 critical, 14 high, 6 medium, 1 low.
A real report on a deliberately broken demo app. Read the full report
The problem
AI writes an app that works. It does not check whether the database is open to anyone with your public key, whether your Stripe webhook accepts forged events, or whether a tracking script fires before your cookie banner does. Veracode’s 2025 GenAI Code Security Report (80 coding tasks, 100+ models) found AI-generated code introduced security vulnerabilities in 45% of test cases.
Three kinds of trouble: an attacker, a regulator, a customer disputing a charge. Each checks different things.
LaunchVet checks for all three, before they do.
Install
Two commands in Claude Code, then ask for the audit.
/plugin marketplace add Lt23live/launchvet
/plugin install launchvet@launchvetOpen Claude Code in your project and type:
/launchvet:launchvetOr just ask: “Run LaunchVet on this app.”
You get launchvet-report.md in your project. Worst finding first. Each one has a prompt you paste into Claude Code to fix it. Run it again to confirm.
Needs Claude Code and Node.js 18 or newer (for the scanner). Prefer a plain skill folder over a plugin? The README has that path too; the command is then /launchvet.
What it checks
The free core runs 26 checks. The full table is in the README.
Security
- Secret keys in code, in public env vars (
NEXT_PUBLIC_,VITE_) and in.envfiles that can be committed - Supabase tables with Row Level Security off, or “allow everyone” policies
- Payment webhooks that do not verify the signature
- Permission checks that exist only in the frontend, and admin APIs with no login
- Records loaded by ID with no check that they belong to the user
- No rate limits on AI calls, login, email and uploads
- SQL built from strings, raw HTML rendering, mass assignment, open redirects, server-side fetching of user URLs, unvalidated uploads, wildcard CORS, tokens in localStorage, source maps in production, stack traces sent to users, old lockfiles
Legal
- No privacy policy page
- No terms of service page
- Analytics and ad pixels that load before consent
- AI used without telling users
Payments
- Price and user id taken from the browser at checkout
- No refund policy, no support contact
- No self-serve cancellation, no auto-renewal terms on the paywall
- Payment webhooks with no signature check
Pro adds more checks (142 in total), a fuller payments and Stripe readiness module, an app store module, legal page starter templates, a CLAUDE.md security rulebook, a fix-prompt library and a pre-launch checklist.
Free vs Pro
| Free (open source, MIT) | Pro ($19, $12 until Nov 11) | |
|---|---|---|
| Checks | 26 | 142 |
| Ranked report | Yes | Yes |
| Fix prompt per finding | Yes | Yes, plus the full fix-prompt library |
| Security, legal and payments basics | Yes | Yes |
| Payments and Stripe readiness module | No | Yes |
| App store module | No | Yes |
| Legal page starter templates (not legal advice) | No | Yes |
CLAUDE.md security rulebook | No | Yes |
| Pre-launch checklist | No | Yes |
| Source code | GitHub, MIT | Download from Gumroad |
| Price | $0 | $19 list, $12 until 2026-11-11 23:59 PT |
Free (open source, MIT)
Try the free core on GitHubPro ($19, $12 until Nov 11)
Get LaunchVet Pro, $12 until Nov 11 (then $19)Start with the free core. If it finds things worth fixing and you want the rest, Pro is there. You do not need Pro to fix what the free core finds.
Who made it
I built LaunchVet with AI assistance and I sell the Pro pack, so weigh my claims accordingly. The free core is open source so you can read exactly what it does.
FAQ
Is it safe to run?
It reads your own repo and writes one file, launchvet-report.md. It never edits your code; you do that yourself when you paste a fix prompt. The free core is open source, so read it first.
Does it send my code anywhere?
LaunchVet runs inside your own Claude Code session. There is no LaunchVet server, no signup, and nothing is uploaded to us. The scanner script makes no network calls. Claude Code itself reads your files and talks to Anthropic the way it does whenever you ask it to work on your repo. The scanner keeps a small log of its last two runs (the folder scanned and the counts, never your code or the findings) next to the script on your own machine.
How is it different from other audit tools?
Hosted scanners ask for your URL or your source code on their server. LaunchVet runs inside your own Claude Code session with no signup, and checks security, legal and payments in one pass. It is a one-time price, not a monthly one. Free Claude Code security skills exist too. LaunchVet adds the legal and payments checks in the same run.
Does it replace a penetration test or a lawyer?
No. It is an automated checklist. It catches common, expensive mistakes quickly. It does not find everything, and it does not give legal advice. If real money, health data or children are involved, hire a professional too.
Will it find everything?
No. Checklists miss things and AI can make mistakes, including in the report. Treat a clean report as “no common issues found”, not as “safe”.
Why pay when the core is free?
The free core covers the highest-impact checks. Pro adds the rest of the checks, the payments module, the app store module, legal page starter templates, the CLAUDE.md rulebook, the fix-prompt library and the pre-launch checklist. If the free core is enough for you, use it and skip Pro.
What if I do not like it?
30 days, no questions. Email [email protected] or request a refund through Gumroad.
Does it work with Cursor, Lovable, Bolt or other tools?
It runs in Claude Code. If your app was built elsewhere, you can still open the repo in Claude Code and run it. The demo report was made on a Next.js, Supabase and Stripe app. The scanner also has patterns for Vite, Nuxt, Expo, Express, FastAPI, Django, Prisma and knex projects, but only the Next.js, Supabase and Stripe case has a demo behind it.
Are the legal templates legal advice?
No. They are starting points. Have a lawyer review them before you rely on them.
Is the launch price real?
Yes. $12 until 2026-11-11 23:59 PT, then $19. The date does not move.
Your app runs. Is it ready to launch?
$12 until Nov 11, then $19. 30-day refund, no questions.
LaunchVet is an automated checklist, not a security guarantee or legal advice. AI is used in this product and can make mistakes.
The Gumroad checkout and GitHub are separate sites with their own policies.
Links: GitHub (Lt23live/launchvet), Pro on Gumroad, [email protected], MIT license.