Free, nothing to install
The pre-ship checklist for apps your agent built
Nine things worth knowing about your app before your users find them. You do not need Jackdaws to work through this list. Every item says what to look for and why it bites.
Before you ship
Is there a shell command with your user's input in it?
If a command is built by joining strings together, someone can end it early and start their own. Look for code that runs a command line, not a function.
Does anything call eval, or build code out of text while it runs?
An agent reaches for it whenever a problem looks dynamic. It means whoever controls that text controls your server.
Did anything turn off certificate checking to make an error go away?
It is the fastest way to silence a connection error. It also removes the only guarantee that you are talking to who you think you are.
Are there passwords or keys sitting in the repo?
Not only in your code — in config files, in lockfiles, and in the plugins you installed. Anything committed stays reachable until it is replaced, not until it is deleted.
Could any of your tests pass without checking anything?
A test that loops over an empty list passes. A test whose cases were built from a list that came back empty passes. Both stay green forever.
Do you know what every plugin and skill you installed tells your agent to do?
Your agent reads them before it reads you. One can quietly instruct it to skip a check or ignore something you asked for.
Can one user reach another user's data?
No scanner will tell you this. Log in as two accounts and try it by hand. It is the most common real breach in apps built this way.
What happens when someone changes a price in the request?
If the amount charged comes from what the browser sent, it is not a price. It is a suggestion.
If your database vanished right now, what would you have?
Find the most recent backup and restore it somewhere. An untested backup is a belief, not a backup.
What the checks review
Items 1 to 6 are visible in your code
Four checks look for exactly these shapes, and each thing they find carries a rule id so you can ask your agent to fix that one thing: code_pattern_audit, vacuous_guard_audit, plugin_manifest_audit and skill_security_audit.
What this doesn’t catch
Items 7 to 9 are on you
No static check will ever find them. They depend on what your app does while it is running, and on decisions only you can make. They are on the list because they cost the most, not because anyone can automate them.