Go-based CLI tool that scans codebases for launch readiness, detecting missing configuration, security hygiene issues, secret leaks, and integration gaps before production deployment.
Preflight.sh is a command-line tool that scans your codebase for launch readiness. Identifies missing configuration, integration issues, security concerns, SEO metadata gaps, and other common mistakes before you deploy to production.
Don't embarrass yourself in production. Just run the command.
brew install preflightsh/preflight/preflight
npm install -g @preflightsh/preflight
go install github.com/preflightsh/preflight@latest
docker pull ghcr.io/preflightsh/preflight
curl -sSL https://preflight.sh/install.sh | sh
Download the latest release from GitHub Releases.
From v0.23.0 each archive carries signed build provenance. To check that a download was built by this repo's release workflow:
gh attestation verify preflight_<version>_<os>_<arch>.tar.gz --repo preflightsh/preflight
# Initialize in your project directory
cd your-project
preflight init
# (asks before replacing an existing preflight.yml; --force skips the question)
# Run all checks
preflight scan
# Scan a specific directory
preflight scan /path/to/project
# Run with verbose output (shows which files matched each check)
preflight scan --verbose
preflight scan -v # short form
# Run in CI mode with JSON output
preflight scan --ci --format json
# Run only specific checks, or skip some, for fast iteration
# (one-off; unlike `preflight ignore` it doesn't change preflight.yml)
preflight scan --only seo_meta,og_twitter
preflight scan --skip vulnerability,secrets
# Silence a check
preflight ignore sitemap
# Unsilence a check
preflight unignore sitemap
# List all check IDs
preflight checks
This repo includes a skills.sh-compatible agent skill at skills/preflight/SKILL.md. It gives coding agents a repeatable Preflight workflow: inspect preflight.yml, run CI-safe scans, triage findings, avoid unsafe ignores, rerun validation, and report residual launch risk.
List the skill from this repository:
# With Bun
bunx --yes skills add preflightsh/preflight --list
# Or with npm
npx --yes skills add preflightsh/preflight --list
Install only the Preflight skill:
# With Bun
bunx --yes skills add preflightsh/preflight --skill preflight
# Or with npm
npx --yes skills add preflightsh/preflight --skill preflight
Preflight is fully usable from the command line with no account. The optional dashboard at app.preflight.sh adds a hosted history of your scans and AI-generated fix suggestions for each finding. Your code never leaves your machine: scanning runs locally, and only check IDs, statuses, controlled status messages, and a redacted configuration summary are sent when you publish. Website URLs are reduced to their origins; raw findings, subprocess output, paths, query strings, and secret values stay local. Dashboard bearer tokens are restricted to the origin that issued them, and authenticated redirects cannot cross origins or downgrade HTTPS.
Create a free account, then connect the CLI:
preflight auth login # opens your browser to authorize this CLI
preflight auth status # show who you're logged in as
preflight auth logout # remove stored credentials
Publish a scan to your dashboard with --publish. It prints a link to view the run. Publishing is best-effort: if you're offline or not logged in, the scan still runs and exits normally.
preflight scan --publish
On the dashboard you get each run's pass/warn/fail breakdown, the list of check outcomes, and a per-project history so you can see what changed between deploys.
You can also read that history from the terminal with preflight history:
preflight history # recent runs across your projects
preflight history --here # only the current project's runs
preflight history <run-id> # one run's full check results
preflight history --here --format json # machine-readable, for agents
Requires preflight auth login. --here matches runs to the current repository by its git remote, the same key used when publishing.
Open any failed or warning check on a published run to generate a step-by-step fix tailored to your detected stack, with copy-ready commands and code.
| Check | Description |
|---|---|
| ENV Parity | Compares .env and .env.example for missing variables |
| Health Endpoint | Verifies site is reachable; auto-detects /health, /healthz, /api/health or falls back to root |
| Vulnerability Scan | Checks for dependency vulnerabilities (bundle audit, npm audit, etc.) |
| SEO Metadata | Checks for title, description, and Open Graph tags |
| OG & Twitter Cards | Validates og:image, twitter:card and social sharing metadata |
| Canonical URL | Verifies canonical link tag is present |
| Viewport | Checks for proper viewport meta tag for mobile |
| Lang Attribute | Validates html lang attribute for accessibility |
| Structured Data | Checks for JSON-LD Schema.org markup |
| Security Headers | Validates HSTS, CSP, X-Content-Type-Options on both prod and staging |
| SSL Certificate | Checks SSL validity and warns before expiration |
| WWW Redirect | Verifies www/non-www redirect to canonical URL |
| Email Auth | Checks SPF/DMARC records for the configured email sending domain (opt-in) |
| Secret Scanning | Finds leaked API keys and credentials in code |
| Debug Statements | Detects console.log, var_dump, debugger left in code |
| Error Pages | Checks for custom 404/500 error pages |
| Image Optimization | Finds large images (>500KB) that hurt load times |
| Legal Pages | Checks for privacy policy and terms of service pages |
| Cookie Consent | Detects cookie consent solution (GDPR/CCPA compliance) |
| Favicon & Icons | Checks for favicon, apple-touch-icon (.png, .webp, .svg), and web manifest |
| robots.txt | Verifies robots.txt exists and has content |
| sitemap.xml | Checks for sitemap presence or generator |
| llms.txt | Checks for LLM crawler guidance file |
| ads.txt | Validates ads.txt for ad-supported sites (opt-in) |
| humans.txt | Checks for humans.txt to credit the team (opt-in) |
| IndexNow | Verifies IndexNow key file for faster search indexing (opt-in) |
| LICENSE | Checks for license file (opt-in, for open source projects) |
Preflight auto-detects and validates configuration for these services:
Payments
Error Tracking & Monitoring
Email & Newsletters
Analytics
Auth
Chat
Notifications
Infrastructure