All 62 checks
Every rule, in full, with no email required. Each one traces to a failure that actually happened in production — if a check can't point at a real incident, it doesn't belong in the list.
Checks are skipped when they don't apply. A repo with no Prisma never runs the Prisma rules, so "62checks" is the catalogue size — your report shows how many actually ran against your code.
build12
Things that make the build produce the wrong artifact, or make it fail on a clean CI machine after passing on yours.
- critical
Build script doesn't run `prisma generate`
build.prisma-generate
- critical
ESM relative imports missing `.js` extensions
build.esm-js-extensions
- high
tsconfig `extends` points above the deploy root
build.tsconfig-extends-above-root
- high
`vercel.json` sets buildCommand without outputDirectory
build.vercel-static-output-dir
- medium
No build script defined
build.no-build-script
- high
No lockfile committed
build.no-lockfile
- medium
Build configured to ignore type or lint errors
build.ignores-type-errors
- critical
`output: 'export'` alongside server-only features
framework.static-export-server-features
- medium
Dockerfile uses `npm install` instead of `npm ci`
build.docker-npm-install
- high
More than one package-manager lockfile
build.competing-lockfiles
- medium
`.nvmrc` and `engines.node` disagree
build.node-version-mismatch
- medium
Dockerfile with no `.dockerignore`
build.no-dockerignore
security28
Credentials in git, headers that don't restrict what you think they restrict, and input paths that reach a database.
- critical
Live credential committed to the repo
security.committed-secret
- critical
`.env` file committed
security.env-committed
- medium
.gitignore doesn't cover .env files
security.gitignore-env
- high
CSP omits `default-src`
security.csp-default-src
- high
Inline event handlers will be silently killed by CSP
security.csp-inline-handlers
- medium
No startup validation of required env vars
security.no-env-validation
- high
Clerk server import with no configured keys
security.clerk-keyless
- medium
API routes with no rate limiting
security.no-rate-limit
- medium
dangerouslySetInnerHTML on possibly-untrusted content
security.dangerous-html
- critical
SQL built by string concatenation
security.sql-concat
- high
CORS allows any origin with credentials
security.cors-wildcard
- critical
Secret-looking value exposed with a public env prefix
security.public-env-secret
- high
`Math.random()` used to generate a token or id
security.math-random-token
- high
`createCipher` / `createDecipher` (no IV)
security.deprecated-cipher
- high
Session cookie set without httpOnly or secure
security.cookie-flags
- critical
`$queryRawUnsafe` with an interpolated value
security.prisma-queryrawunsafe
- high
Redirect target taken straight from the request
security.open-redirect
- critical
`eval` / `new Function` in a request path
security.eval-request-data
- critical
Registry auth token committed in `.npmrc`
security.npmrc-token
- high
JWT verified without pinning the algorithm
security.jwt-no-algorithm-pin
- critical
Shell command built by interpolation
security.command-injection
- critical
File path built from request input
security.path-traversal
- high
`cors()` mounted with no configuration
security.express-cors-default
- high
JWT signed with no expiry
security.jwt-no-expiry
- medium
bcrypt cost factor below 10
security.bcrypt-rounds
- critical
Privileged database key referenced in a client component
security.service-key-client
- high
Cron endpoint with no secret check
security.unprotected-cron
- medium
`.env.example` contains what look like real values
security.env-example-real-value
deploy3
Platform-specific traps — environment variable names, migration ordering, and config that only bites once it's live.
- high
Reading UPSTASH_REDIS_REST_* on Vercel
deploy.upstash-env-prefix
- low
No Node version pinned
deploy.no-node-version
- medium
Prisma schema with no migrations directory
deploy.prisma-no-migrations
correctness12
Logic that works until a specific sequence happens: dropped webhook events, killed background work, schema rejections.
- high
Webhook marked processed before the handler succeeds
deploy.webhook-idempotency-order
- low
Synchronous setState inside useEffect
correctness.setstate-in-effect
- medium
z.optional() in an OpenAI structured-output schema
correctness.openai-strict-optional
- medium
Un-awaited async work in a serverless handler
correctness.floating-promise-serverless
- high
`params` / `searchParams` used without await on Next 15+
framework.next15-sync-params
- high
`cookies()` / `headers()` used without await on Next 15+
framework.next15-sync-cookies
- critical
Stripe webhook verifying a parsed body
correctness.stripe-webhook-parsed-body
- medium
Conflicting route segment config
framework.conflicting-route-config
- medium
`useEffect` given an async callback
correctness.async-useeffect
- medium
`setInterval` in an effect with no cleanup
correctness.interval-no-cleanup
- medium
Request body parsed without handling malformed JSON
correctness.unguarded-json-parse
- medium
App Router with no `error.tsx`
correctness.no-error-boundary
performance5
Assets and settings that quietly cost you Core Web Vitals, usually the ones nothing in your toolchain looks at.
- medium
`app/icon.png` is large enough to hurt LCP
perf.app-icon-size
- medium
Next.js image optimization disabled globally
perf.images-unoptimized
- low
No cache headers configured
perf.no-cache-headers
- low
`next/image` with `fill` and no `sizes`
perf.image-fill-no-sizes
- high
Database query inside a loop (N+1)
perf.query-in-loop
compliance2
Legal obligations that attach the moment you collect an email address or send a commercial message.
- medium
Collects email but has no privacy policy page
compliance.no-privacy-policy
- high
Sends email with no unsubscribe path
compliance.no-unsubscribe
Think a check is wrong?
A false positive costs more trust than a missed finding earns, so we'd genuinely rather hear about it. Mail ceo@theappmakerpro.com with the repo and the rule id.
Run it on your repo →