LaunchVet

Your vibe-coded app runs. Is it ready to launch?

An attacker, a regulator and a customer disputing a charge each check different things. LaunchVet checks for all three before they do: security, legal and payments, inside Claude Code, on your own repo. You get one file, launchvet-report.md, with a verdict, every problem ranked from critical to low with the file and line, and a copy-paste fix prompt for each one.

Install it in Claude Code (you also need Node.js 18 or newer for the scanner):

/plugin marketplace add Lt23live/launchvet
/plugin install launchvet@launchvet

Then run /launchvet:launchvet, or ask Claude: "Run LaunchVet on this app." Prefer a plain skill folder? See Option B below; there the command is /launchvet.

The free core is MIT licensed and has 26 checks. It runs inside your own Claude Code session: no LaunchVet server, no signup, nothing is uploaded to us. The scanner script makes no network calls. LaunchVet never edits your code; the only file it writes in your project is the report.

Read a real report on a deliberately broken demo app: examples/broken-app/launchvet-report.md.

Want more? LaunchVet Pro adds more checks (142 in total), payments and Stripe readiness, an app store module, legal page starter templates, a CLAUDE.md security rulebook, a fix-prompt library and a pre-launch checklist: https://greystatedevelopment.gumroad.com/l/launchvet

LaunchVet is an automated checklist, not a security guarantee or legal advice. AI is used in this product and can make mistakes.

What you need

• Claude Code
• Node.js 18 or newer (for the scanner script). Check with node --version.

Install

Pick one of the two ways.

Option A: as a Claude Code plugin

Inside Claude Code, type:

/plugin marketplace add Lt23live/launchvet
/plugin install launchvet@launchvet

The install command does not finish on its own: Claude Code opens the plugin panel and asks where to install it. Choose to install it for you (user scope) so it works in every project, then confirm.

Then run it with /launchvet:launchvet, or just ask Claude: "Run LaunchVet on this app."

Updating: plugins from third-party marketplaces like this one do not update automatically. To get a new version, run these two commands in a terminal, in this order, then restart Claude Code. The first one refreshes the marketplace so the second one can see the new version:

claude plugin marketplace update launchvet
claude plugin update launchvet@launchvet

Option B: as a plain skill folder

In a terminal (macOS, Linux, or Git Bash on Windows):

git clone https://github.com/Lt23live/launchvet.git
mkdir -p ~/.claude/skills
cp -r launchvet/skills/launchvet ~/.claude/skills/launchvet

In Windows PowerShell:

git clone https://github.com/Lt23live/launchvet.git
New-Item -ItemType Directory -Force "$HOME\.claude\skills" | Out-Null
Copy-Item -Recurse launchvet\skills\launchvet "$HOME\.claude\skills\launchvet"

Restart Claude Code, then run it with /launchvet.

Run it

1. Open your project folder in Claude Code.
2. Type /launchvet (or /launchvet:launchvet if you installed the plugin). To audit a subfolder, add its path: /launchvet apps/web.
3. Claude runs the scanner, reads the code for the checks a script cannot do, and writes launchvet-report.md in your project folder.
4. Open the report. Start with the critical findings. Copy a fix prompt, paste it into Claude Code, and review the change before you accept it.
5. Run /launchvet again after fixing, and after every big AI-generated change.

LaunchVet never edits your code. The only file it writes is the report.

You can also run only the scanner part, without Claude. With Option B:

node ~/.claude/skills/launchvet/scan.mjs path/to/your/app --text

With the plugin (Option A), the easiest way is to clone the repo once and run the same file from there:

git clone https://github.com/Lt23live/launchvet.git
node launchvet/skills/launchvet/scan.mjs path/to/your/app --text

The scanner groups repeated hits of the same rule in the same file into one finding with a list of lines, so a file with ten similar queries shows up once.

What it checks

The free version has 26 checks.

16 run as a local script (scan.mjs), the same way every time:

ID	Check
LV001	Secret keys hardcoded in code (Stripe, OpenAI, Anthropic, AWS, GitHub, Supabase service role, private keys and more)
LV002	Secrets in public env vars (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_ and similar) that get bundled into the browser
LV003	.env files that are tracked by git, not ignored, or in a public folder
LV004	.gitignore that does not ignore .env files
LV005	Wildcard CORS
LV006	Supabase tables without Row Level Security, RLS switched off, and "allow everyone" policies
LV007	SQL built from strings (SQL injection), unsafe raw queries, Supabase filters built from user input
LV008	Raw HTML rendering without sanitizing (XSS)
LV009	Login tokens stored in localStorage
LV010	Source maps published in production
LV011	No privacy policy page
LV012	No terms of service page
LV013	Analytics and ad pixels that load with no consent check
LV014	Payment webhooks that do not verify the signature
LV015	Missing, duplicate or stale lockfiles
LV016	Stack traces and error details sent to users

10 are read and judged by Claude, because a pattern match cannot decide them:

This is the beginning of the README. Read the rest at the original. Read the full README ↗