The pre-flight check for AI-built apps
All 60 checks — what DevMeth looks for
DevMeth checks the 48 known AI-code failure patterns. 48 security checks cover the known AI-code failure patterns; the 12-check Rescue ruleset covers AI tech debt — what the agent left behind. Each check has a plain-English page: what the issue is, why AI tools produce it, how we detect it, and the fix. Run a free scan to see which apply to your app.
Secrets in code
- C1Hardcoded API Keys Check — Are Secrets in Your Code?
- C10Database Password in Code Check — Is a Connection Password in Your Source?
- C2Secrets in Git History Check — Are Deleted Keys Still Recoverable?
- C26.gitignore Gaps Check — Does Your Ignore Keep Secrets Out of the Repo?
- C29Seed & Backup Data Leak Check — Is Real User Data in Your Repo?
- C3Committed .env File Check — Are Your Real Credentials in the Repo?
- C30.env.example Real Values Check — Are Placeholders Actually Placeholders?
- C4Secrets in Client Bundle Check — Is Your Key Shipped to Every Browser?
- C5Live Secret in JS Check — Is a Real Key in the JavaScript Your Site Serves?
- C8Supabase Service Role Key Check — Is Your Admin Key in Browser Code?
Exposed data
- C11Browser Direct Database Check — Does Your App Talk to the DB from the Browser?
- C41Public Storage Bucket Check — Are User Uploads World-Readable?
- C6Supabase RLS Check — Is Your Database Publicly Readable?
- C7Supabase Permissive Policy Check — Does Your Policy Allow-Read to Everyone?
- C9Firebase Security Rules Check — Can Anyone Read or Write Your Data?
Access & auth
- C12Authless Route Handler Check — Does Your API Trust Anyone Who Calls?
- C13Open Admin Page Check — Is Your Dashboard Behind a Login?
- C14JWT Misuse Check — Can Your Session Tokens Be Forged or Stolen?
- C15Login Rate Limit Check — Can Your Auth Endpoints Be Sprayed?
- C16Password Reset Token Check — Are Your Reset Links Guessable?
- C17Client-Side Role Check — Do You Trust the Browser for Who's Admin?
- C31IDOR Check — Can Users Reach Each Other's Records by Changing an Id?
- C34Password Storage Check — Are Passwords Actually Hashed Before Saving?
- C37Math.random() Token Check — Are Your Tokens Actually Unguessable?
- C42OAuth State Check — Is Your Social Login CSRF-Proof?
- C46Seed Credentials Check — Does admin/admin123 Still Work?
- C47JWT Secret Check — Can Anyone Forge Your Session Tokens?
Input handling
- C18SQL Injection Check — Is User Input Concatenated Into Your Queries?
- C19Unvalidated Input Check — Does Request Data Flow Straight Into Writes or Shell?
- C21Upload Endpoint Check — Does Your Upload Accept Any File, No Limits?
- C32Webhook Signature Check — Are Your Endpoints Verifying Providers?
- C33Mass Assignment Check — Can Users Overwrite Fields They Never Saw?
- C35Payment Amount Check — Can Customers Set Their Own Price?
- C38Raw HTML Render Check — Can a Chat Message Run Script in Another User's Browser?
- C39SSRF Check — Can Users Make Your Server Fetch Internal URLs?
- C40Secrets in Logs Check — Is Your Token in the Log Store?
- C44Path Traversal Check — Can /files/../../.env Read Your Secrets?
Dependencies
Public web surface
- C20Wide-Open CORS Check — Can Any Site Read Your Responses with Your Cookies?
- C22Stack Trace Leak Check — Do Your Error Responses Leak Internal Details?
- C25Exposed Git Metadata Check — Does Your Deployed Site Serve Its Git Files?
- C27Debug Endpoint Check — Are Dev Routes Live in Production?
- C28HTTPS & HSTS Check — Does Your Site Force Secure Connections?
- C43Public Cron Endpoint Check — Can Anyone Run Your Scheduled Jobs?
- C45Paid AI Endpoint Check — Is Anyone Else Spending Your API Budget?
- C48CI Secret Exposure Check — Can a Pull Request Steal Your Deploy Keys?
AI code debt
- R1Dead Exports Check — Is Your Codebase Carrying Unused Exports?
- R10Swallowed Errors Check — Are Your Error Handlers Doing Nothing?
- R11Prisma Migration Drift Check — Do Your Models Have Migrations?
- R12Agent Residue Check — Are Session Files Committed to Your Repo?
- R2Duplicated Code Check — Are Identical Blocks Pasted Across Your Codebase?
- R3Divergent Copy Check — Did Copies of the Same Code Drift Apart?
- R4Broken Imports & Unused Dependencies Check — Did the Agent Leave Dead References?
- R5Untested Mutating Routes Check — Do Your Write Endpoints Have Tests?
- R6API Spec Drift Check — Does Your README Still Match Your Routes?
- R7God File Check — Are Your Source Files Overgrown Past 800 Lines?
- R8Dependency Sprawl Check — Do Multiple Packages Do the Same Job?
- R9Comment Rot Check — Is Commented-Out Code and TODO Debt Piling Up?
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.