launchworthy plugin
Claude Code plugin that audits AI-built apps across five domains with a scorecard and a punch list with file paths.
- 95 ★ on the repository
- Last commit
Minimal access
Why this level
- The plugin reads project files and writes a report to `tmp/` without changing code unless you ask.
Install
- Works in
Manual install
/plugin marketplace add wunderlandmedia/launchworthyThen `/plugin install launchworthy@wunderlandmedia` and enable auto-update through `/plugin`.
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- The plugin reads project files and writes a report to `tmp/` without changing code unless you ask.
This is third-party code. Review the repository files before installing.
What it does
launchworthy checks an app built in Lovable, Bolt, v0, Cursor or Claude Code across five domains between works for me and nothing is on fire in production: frontend and experience, backend and data, auth and security, infrastructure and deployment, and operations and recovery. The plugin detects the framework and backend itself, including Next.js, SvelteKit, Astro, Remix, Supabase, Firebase and Prisma, and adapts the checks to them. The result is written to `tmp/hardening-<project>-<date>.md`: a score per domain and a punch list by urgency with exact file paths and copy-paste fixes. Anything that cannot be verified is marked `MANUAL CHECK NEEDED` and is never counted as a pass.
Who it is for. Founders and developers without a security background who shipped an app with AI help and do not know what they do not know.
Good fit when
- A Supabase app is heading to its first paying users and you need to confirm RLS is on.
- Secrets may have leaked into the client bundle or git history.
- You need to check backups, deploy rollback and error monitoring.
- You fixed the blockers and want to see progress on a re-run.
Not a fit when
- You need a penetration test with active exploitation.
- The project is not web related, such as a game or a library.
- You need a guarantee the app cannot be hacked.
Example request
Check whether my app is ready to launch for real users and produce a fix list ordered by urgency.Limitations
The plugin runs an audit without exploiting vulnerabilities: passing all five domains means the app is no longer an easy target, which does not make it unhackable. A third of the checks lie outside the code, for example restoring a backup and 2FA at the domain registrar, so the plugin asks you questions and records your answers as reported by user, unverified, never as passes. A domain with an unverified critical check is capped at a warning. Auto-update for third-party marketplaces in Claude Code is off by default and is enabled through `/plugin`.
How to disable. Run `/plugin uninstall launchworthy@wunderlandmedia`. Reports in `tmp/` stay in the project and are deleted by hand.
FAQ
Which five domains does the plugin check?
Frontend and experience, backend and data, auth and security, infrastructure and deployment, and operations and recovery.
Why use it over a plain code review request?
It applies a fixed checklist, raises topics you did not ask about and does not pass a check it cannot verify. A re-run scores by the same list, so progress is comparable.
Where is the report?
In `tmp/hardening-<project>-<date>.md` inside your project. A sample report is in `examples/sample-report.md` in the repository.
Do I have to specify the framework?
No. The plugin detects the framework and backend itself and adapts the checks.
What does MANUAL CHECK NEEDED mean?
The plugin could not verify the item itself. Such an item never passes without your confirmation, and your answer is recorded as unverified.
Discussion
No questions or reviews yet.
Related
PluginsA Claude Code marketplace from Trail of Bits: 29 plugins with hooks and scripts reviewed line by line, from fuzzing and Ghidra to documents
A code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
An open set of Claude Code plugins for compliance: findings from cloud and SaaS, gap reports and OSCAL output
A Claude Code plugin that helps write bug bounty reports from verified facts only, with nothing invented
Skill that scans a project for common vibe-coding holes: keys in code, .env in git, open LLM endpoints and weak auth.
README in short
A plugin and marketplace in one repository: a skill with a checklist, an evidence interview reference and fix playbooks by topic from account deletion to Firebase rules. A 0 of 5 score turns into 5 of 5 as you fix things.