Preflight.sh

Preflight.sh is a command-line tool that scans your codebase for launch readiness. Identifies missing configuration, integration issues, security concerns, SEO metadata gaps, and other common mistakes before you deploy to production.

Don't embarrass yourself in production. Just run the command.

Installation

Homebrew (macOS/Linux)

brew install preflightsh/preflight/preflight

npm

npm install -g @preflightsh/preflight

Go

go install github.com/preflightsh/preflight@latest

Docker

docker pull ghcr.io/preflightsh/preflight

Shell Script

curl -sSL https://preflight.sh/install.sh | sh

Manual Download

Download the latest release from GitHub Releases.

Quick Start

# Initialize in your project directory
cd your-project
preflight init

# Run all checks
preflight scan

# Scan a specific directory
preflight scan /path/to/project

# Run with verbose output (shows which files matched each check)
preflight scan --verbose
preflight scan -v  # short form

# Run in CI mode with JSON output
preflight scan --ci --format json

# Run only specific checks, or skip some, for fast iteration
# (one-off; unlike `preflight ignore` it doesn't change preflight.yml)
preflight scan --only seoMeta,ogTwitter
preflight scan --skip vulnerability,secrets

# Silence a check
preflight ignore sitemap

# Unsilence a check
preflight unignore sitemap

# List all check IDs
preflight checks

Agent Skill

This repo includes a skills.sh-compatible agent skill at skills/preflight/SKILL.md. It gives coding agents a repeatable Preflight workflow: inspect preflight.yml, run CI-safe scans, triage findings, avoid unsafe ignores, rerun validation, and report residual launch risk.

List the skill from this repository:

# With Bun
bunx --yes skills add preflightsh/preflight --list

# Or with npm
npx --yes skills add preflightsh/preflight --list

Install only the Preflight skill:

# With Bun
bunx --yes skills add preflightsh/preflight --skill preflight

# Or with npm
npx --yes skills add preflightsh/preflight --skill preflight

Dashboard & AI Suggestions

Preflight is fully usable from the command line with no account. The optional dashboard at app.preflight.sh adds a hosted history of your scans and AI-generated fix suggestions for each finding. Your code never leaves your machine: scanning runs locally, and only a redacted summary of results (check IDs, statuses, and messages, never secret values or file contents) is sent when you publish.

Create a free account, then connect the CLI:

preflight auth login    # opens your browser to authorize this CLI
preflight auth status   # show who you're logged in as
preflight auth logout   # remove stored credentials

Publish a scan to your dashboard with --publish. It prints a link to view the run. Publishing is best-effort: if you're offline or not logged in, the scan still runs and exits normally.

preflight scan --publish

On the dashboard you get each run's pass/warn/fail breakdown, the full list of findings, and a per-project history so you can see what changed between deploys.

You can also read that history from the terminal with preflight history:

preflight history                       # recent runs across your projects
preflight history --here                # only the current project's runs
preflight history <run-id>              # one run's full check results
preflight history --here --format json  # machine-readable, for agents

Requires preflight auth login. --here matches runs to the current repository by its git remote, the same key used when publishing.

Open any failed or warning check on a published run to generate a step-by-step fix tailored to your detected stack, with copy-ready commands and code.

• Free includes 5 published runs per month.
• Bring your own key: add an OpenAI or Anthropic API key in your dashboard settings and publishing stays free and unlimited (you pay your provider directly).
• Managed ($5/mo): we cover the AI costs and runs are unlimited, no API key required.

What It Checks

Supported Services (72)

Preflight auto-detects and validates configuration for these services:

Payments

• Stripe, PayPal, Braintree, Paddle, LemonSqueezy

Error Tracking & Monitoring

• Sentry, Bugsnag, Rollbar, Honeybadger, Datadog, New Relic, LogRocket

Email & Newsletters

• Postmark, SendGrid, Mailgun, AWS SES, Resend, Mailchimp, Kit, Beehiiv, AWeber, ActiveCampaign, Campaign Monitor, Drip, Klaviyo, Buttondown

Analytics

• Plausible, Fathom, Umami, Fullres Analytics, Datafa.st Analytics, Google Analytics, PostHog, Mixpanel, Amplitude, Segment, Hotjar

Auth

• Auth0, Clerk, WorkOS

Chat

• Intercom, Crisp

Notifications

• Slack, Discord, Twilio

Infrastructure

• Firebase, Supabase, Redis, Sidekiq, RabbitMQ, Elasticsearch, Convex

Storage & CDN

• AWS S3, Cloudinary, Cloudflare

Search

• Algolia

SEO

• IndexNow

AI / LLMs

• OpenAI, Anthropic Claude, Google AI (Gemini), Mistral, Cohere, Replicate, Hugging Face, Grok (X/Twitter), Perplexity, Together AI

Configuration

Preflight uses a preflight.yml file in your project root:

projectName: my-app
stack: rails  # rails, next, react, vite, laravel, etc.

urls:
  staging: "https://staging.example.com"
  production: "https://example.com"

services:
  stripe:
    declared: true
  sentry:
    declared: true

checks:
  envParity:
    enabled: true
    envFile: ".env"
    exampleFile: ".env.example"

  healthEndpoint:
    enabled: true
    path: "/health"  # optional - auto-detects common paths if not set

  stripeWebhook:
    enabled: true
    url: "https://api.example.com/webhooks/stripe"

  seoMeta:
    enabled: true
    mainLayout: "app/views/layouts/application.html.erb"

  security:
    enabled: true

  secrets:
    enabled: true
    # Per-file allowlist for the secrets scan. Use this to suppress an
    # individual finding (e.g. a referrer-restricted public key) without
    # disabling the whole check.
    allowlist:
      - path: web/js/golden-hour.js
        fingerprint: "sha256:<hex>"   # recommended — pins to the exact secret
        reason: "HTTP-referrer-restricted Google Timezone key"
      - path: "web/tools/**/*.php"    # doublestar globs are supported

  indexNow:
    enabled: true
    key: "your32characterhexkeyhere00000"

  emailAuth:
    enabled: true  # opt-in, checks SPF/DMARC on production domain

  humansTxt:
    enabled: false  # opt-in, credits the team

  license:
    enabled: false  # opt-in, for open source projects

# Silence specific checks or services by ID
ignore:
  - sitemap
  - llmsTxt
  - google_analytics

Ignoring Checks & Services

Silence specific checks or services using preflight ignore <id>:

preflight ignore sitemap        # Ignore sitemap check
preflight ignore sentry         # Ignore Sentry service validation
preflight unignore sitemap      # Re-enable sitemap check
preflight checks                # List all ignorable IDs

Allowlisting a single secrets finding

Prefer allowlisting an individual finding over silencing the whole secrets check. Add one-off exceptions from the command line:

preflight ignore secrets web/js/golden-hour.js

That appends a path entry under checks.secrets.allowlist in your preflight.yml. The path field is a doublestar glob (** matches across directories) resolved against the project-relative file path.

Pin the fingerprint. A path-only allowlist silently accepts any future secret dropped into that file. Edit the entry and add a fingerprint: "sha256:<hex>" — the SHA-256 of the detected secret value. Now if the key is rotated or a different secret shows up in the same file, preflight re-alerts.

Findings are matched by path + fingerprint, not whole-file. An allowlisted fingerprint in a file does not suppress other secrets on other lines in the same file.

Ignorable Check IDs

SEO & Social: seoMeta, canonical, structured_data, indexNow (opt-in), ogTwitter, viewport, lang

Security & Infrastructure: securityHeaders, ssl, www_redirect, email_auth (opt-in), secrets

Environment & Health: envParity, healthEndpoint

Code Quality & Performance: vulnerability, debug_statements, error_pages, image_optimization

Legal & Compliance: legal_pages

Web Standard Files: favicon, robotsTxt, sitemap, llmsTxt, adsTxt (opt-in), humansTxt (opt-in), license (opt-in)

Ignorable Service IDs

All services have validation checks that verify proper integration (env vars, SDK patterns, config files):

Payments: stripe, paypal, braintree, paddle, lemonsqueezy

Error Tracking: sentry, bugsnag, rollbar, honeybadger, datadog, newrelic, logrocket

Transactional Email: postmark, sendgrid, mailgun, aws_ses, resend

Email Marketing: mailchimp, convertkit, beehiiv, aweber, activecampaign, campaignmonitor, drip, klaviyo, buttondown

Analytics: plausible, fathom, google_analytics, fullres, datafast, posthog, mixpanel, amplitude, segment, hotjar

Auth: auth0, clerk, workos, firebase, supabase

Communication: twilio, slack, discord, intercom, crisp

Infrastructure: redis, sidekiq, rabbitmq, elasticsearch, convex

Storage & CDN: aws_s3, cloudinary, cloudflare

Search: algolia

AI: openai, anthropic, google_ai, mistral, cohere, replicate, huggingface, grok, perplexity, together_ai

SEO: indexNow

Cookie Consent: cookieconsent, cookiebot, onetrust, termly, cookieyes, iubenda

Exit Codes

Codes 1 and 2 mean the scan ran and reported something. Code 64 means it never got that far, so CI can tell "this project has problems" apart from "this invocation was wrong".

Shell Completions

Tab completion for commands, flags, and check IDs (including --only and --skip values):

# bash (add to ~/.bashrc)
source <(preflight completion bash)

# zsh (add to ~/.zshrc)
source <(preflight completion zsh)

# fish
preflight completion fish | source

Output also respects the NO_COLOR environment variable.

Supported Stacks

Backend Frameworks

• Ruby on Rails, Laravel, PHP, Go, Python/Django, Rust, Node.js

Frontend Frameworks

• Next.js, Nuxt, Remix, React, Vue.js, Vite, Svelte, Angular

Traditional CMS

• WordPress, Craft CMS, Drupal, Ghost

Static Site Generators

• Hugo, Jekyll, Gatsby, Eleventy (11ty), Astro

Headless CMS

• Strapi, Sanity, Contentful, Prismic

Other

• Static sites

CI Integration

# GitHub Actions example (curl)
- name: Run Preflight
  run: |
    curl -sSL https://preflight.sh/install.sh | sh
    preflight scan --ci --format json

# GitHub Actions example (Docker)
- name: Run Preflight
  run: docker run -v ${{ github.workspace }}:/app ghcr.io/preflightsh/preflight scan --ci --format json

License

MIT