The "Vibe Coder" Problem:
AI coding assistants (Cursor, GitHub Copilot, ChatGPT, v0, Bolt) overwhelmingly generate code in Next.js and React because:
- 📊 80%+ of AI-generated web apps use Next.js or React
- 🤖 LLM training data is heavily weighted toward these frameworks
- 🚀 "Vibe coders" (developers who rely heavily on AI) primarily ship in this stack
Our Mission: Catch the security holes and SEO gaps that AI assistants create before you deploy.
While all JavaScript/TypeScript projects are supported, we've optimized our rules for the frameworks where AI makes the most mistakes. As AI coding expands to other languages, so will ProdReady.
ProdReady is an open-source security, SEO, and code quality scanner for JavaScript/TypeScript projects. It performs 50+ automated checks in seconds to catch issues that AI coding assistants often miss before you deploy to production.
Optimized for Next.js with full support for React, Vue, Node.js, and any JS/TS codebase.
| Language/Framework | Support Level | Notes |
|---|---|---|
| Next.js | ✅ Full | Optimized with framework-specific checks |
| React | ✅ Full | Component-level security & accessibility |
| TypeScript | ✅ Full | Type safety checks, any detection |
| JavaScript | ✅ Full | ES6+, CommonJS, ESM |
| Vue.js | JS/TS checks work, framework checks planned | |
| Node.js | Security checks work, API-specific checks planned | |
| Svelte | Basic checks only | |
| Angular | Basic checks only | |
| Python/Ruby/Go | 🔜 Planned | Coming in future versions |
Current Version (v1.0):
- ✅ Public repositories - Full access, no authentication required
- ❌ Private repositories - Not supported yet
Why? The scanner uses GitHub's public API without authentication. This is perfect for open-source projects but can't access private repos.
Coming Soon (Phase 3):
- 🔜 GitHub OAuth integration
- 🔜 Personal access token support
- 🔜 Scan your private repositories securely
- 🔜 Team/organization repository access
Workaround for Private Repos:
- Clone your repo locally
- Run ProdReady locally (see Local Setup)
- Point scanner to local directory (feature coming soon)
AI coding assistants (Cursor, GitHub Copilot, ChatGPT, v0, Bolt) are revolutionizing development speed, but they're also creating a new class of security and quality issues:
| What AI Does Wrong | Why It Matters | Real Impact |
|---|---|---|
| 🔑 Exposed API keys | Hardcodes secrets in code | → Unauthorized access, $1000s in API bills |
| 🕳️ Missing input validation | Skips sanitization | → Injection attacks, data breaches |
| 🐛 Debug code in production | Leaves console.logs, test routes | → Exposes internal logic to attackers |
| 🔍 No SEO metadata | Forgets <title>, OG tags |
→ Invisible to Google, no social shares |
| 🔓 Hardcoded secrets | Commits .env values |
→ Scraped from public repos in minutes |
| ♿ Poor accessibility | Missing alt text, ARIA labels | → Excludes users, violates WCAG |
| 🎨 Inline styles everywhere | Hardcoded colors, magic numbers | → Unmaintainable, inconsistent UI |
| 🗑️ Zombie code | Unused imports, empty components | → Bloated bundles, slower load times |
The "Vibe Coder" Reality:
- ✅ AI writes your app in hours instead of weeks
- ❌ But ships with security holes you won't notice until it's too late
- 🚨 68% of AI-generated code has at least one security issue (GitHub, 2024)
ProdReady is your safety net. Scan before you ship, catch what AI missed, deploy with confidence.
- API Key Detection - Finds exposed OpenAI, Stripe, AWS, and other API keys
- Secret Scanning - Detects hardcoded credentials and tokens
- XSS Prevention - Identifies dangerous
dangerouslySetInnerHTMLusage - .env File Protection - Ensures environment files are gitignored
- Input Validation - Checks for missing form validation
- External Link Safety - Detects unsafe
target="_blank"withoutrel="noopener"
- Metadata Validation - Ensures proper
<title>,<meta>tags - OpenGraph Tags - Verifies social media preview configuration
- Image Alt Text - Finds images missing accessibility attributes
- Semantic HTML - Detects div soup and missing semantic elements
- robots.txt & sitemap.xml - Checks for essential SEO files
- Favicon Verification - Ensures custom branding is in place
- Console.log Detection - Finds debug statements in production code
- Unused Imports - Identifies zombie imports bloating your bundle
- TODO Comments - Flags unfinished work before deployment
- TypeScript Safety - Detects dangerous
anytypes - Hardcoded Values - Finds hardcoded colors, URLs, and magic numbers
- Empty Components - Identifies components that return null
| Feature | ESLint | IDE Tools | ProdReady |
|---|---|---|---|
| Security vulnerability detection | ✅ Full | ||
| SEO & accessibility checks | ❌ None | ❌ None | ✅ Full |
| Cross-file analysis | ✅ Full | ||
| Zero configuration | ❌ None | ✅ Full | |
| Pre-launch checklist | ❌ None | ❌ None | ✅ Full |
| Actionable fix guides | ✅ Full | ||
| Works on any public repo | ❌ None | ❌ None | ✅ Full |
ProdReady complements your existing tools - it's not a replacement, it's your final check before shipping.
- Visit prod-ready-navy.vercel.app
- Paste your GitHub repository URL
- Get your security report in 30 seconds
# Clone the repository
git clone https://github.com/MrForward/ProdReady.git
cd prodready
# Install dependencies
npm install
# Set up environment variables
cp env.example.txt .env.local
# Add your Supabase credentials (optional for email capture)
# Run development server
npm run dev
# Open http://localhost:3000See Deployment Guide for detailed instructions.
- Paste Repository URL - Any public GitHub repository
- Instant Scan - 50+ checks run automatically in 30 seconds
- Get Report - See every issue with severity, location, and fix guide
- Fix Issues - Copy AI-ready prompts for your coding assistant
🎯 Vibe Score: 81/100 (Grade B)
✅ 16 Checks Passed
❌ 3 Issues Found
🔴 CRITICAL: Exposed API Key
File: src/lib/openai.ts:12
Fix: Move to environment variable
🟡 MEDIUM: Missing Alt Text
File: src/components/hero.tsx:45
Fix: Add descriptive alt attribute
🟢 LOW: Console.log in Production
File: src/app/page.tsx:89
Fix: Remove or use proper logging
- Framework: Next.js 16 (App Router)
- Language: TypeScript 5
- Styling: Tailwind CSS 4
- UI Components: Radix UI
- Database: Supabase (PostgreSQL)
- Deployment: Vercel
- Scanner Engine: Custom AST analysis + GitHub API
We welcome contributions! ProdReady is open-source and community-driven.
- Add New Security Rules - Help us detect more vulnerabilities
- Improve Fix Guides - Make our recommendations more actionable
- Report Bugs - Found an issue? Open an issue
- Improve Documentation - Help others understand ProdReady
- Spread the Word - Star the repo, share on Twitter
# Fork and clone the repository
git clone https://github.com/YOUR_USERNAME/ProdReady.git
# Install dependencies
npm install
# Create a branch
git checkout -b feature/your-feature-name
# Make your changes and test
npm run dev
npm run build
# Submit a pull requestSee CONTRIBUTING.md for detailed guidelines.
- ✅ Catch security issues before deployment
- ✅ Ensure SEO best practices
- ✅ Clean up AI-generated code
- ✅ Pre-deployment checklist in CI/CD
- ✅ Code review automation
- ✅ Onboarding new developers
- ✅ Client project audits
- ✅ Quality assurance
- ✅ Competitive analysis
- 50+ security, SEO, and hygiene checks
- GitHub integration
- Real-time scanning
- Detailed reports with fix guides
- One-click AI-powered fixes
- Pull request generation
- Batch issue resolution
- GitHub OAuth - Scan private repositories
- Personal Access Tokens - Secure authentication
- GitHub Actions integration
- GitLab CI support
- Slack/Discord notifications
- API for custom integrations
- Python support (Django, Flask)
- Ruby support (Rails)
- Go support
- PHP support (Laravel)
- Java/Kotlin support
- Custom rule creation
- Team collaboration
- Historical tracking
- Performance benchmarking
Vote for which feature you want next →
We believe security and code quality tools should be:
- Transparent - You can see exactly what we check
- Trustworthy - No black box algorithms
- Customizable - Add your own rules
- Free - No paywalls for basic security
ProdReady will always be free and open-source.
ProdReady is MIT licensed.
Built with:
- Next.js - React framework
- Tailwind CSS - Styling
- Radix UI - UI components
- Supabase - Database
- Vercel - Hosting
Ready to ship production-ready code?
- Try it now: prod-ready-navy.vercel.app
- Star the repo: Help others discover ProdReady
- Share feedback: Open an issue