prodlint

prodlint

Production readiness for vibe-coded apps.

Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues common in code from tools like Claude Code, Cursor, v0, Bolt, and Copilot: hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules.

npx prodlint

  prodlint v0.10.8

Scanned 6 files · 3 critical · 2 warnings · 1 info

app/api/users/route.ts 3:1 CRIT API route has no authentication check auth-checks ↳ Add authentication check: const session = await auth(); if (!session) return new Response('Unauthorized', { status: 401 }) 4:1 WARN Request body accessed without validation (consider using Zod, Yup, or similar) input-validation ↳ Validate input with Zod or a similar schema library before using it 3:1 INFO No rate limiting — anyone could spam this endpoint and run up your API costs rate-limiting ↳ Add rate limiting: import { Ratelimit } from '@upstash/ratelimit' or use express-rate-limit 3:1 WARN API route handler has no try/catch block error-handling ↳ Wrap the handler body in try/catch and return appropriate error responses

lib/format.ts 1:1 CRIT Package "currency-format-utils" is imported but not in package.json hallucinated-imports ↳ Verify the package exists on npm. The AI may have invented this package name.

lib/stripe.ts 3:35 CRIT Hardcoded Stripe secret key detected secrets ↳ Move the secret to an environment variable and access via process.env.SECRET_NAME

Scores security 82 ████████████████░░░░ (4 issues) reliability 90 ██████████████████░░ (2 issues) performance 100 ████████████████████ (0 issues) ai-quality 100 ████████████████████ (0 issues)

Overall: 90/100

3 critical · 2 warnings · 1 info

Add to your README:

That's what prodlint prints for the six-file app in tests/fixtures/readme-demo. A test fails if this block and the scanner ever disagree.

Why?

Vibe coding is the fastest way to build. Shipping fast means knowing your code is production-ready — not just that it compiles. Hardcoded secrets, hallucinated packages, missing auth, and XSS vectors pass type-checks and look correct — but they aren't ready for production.

prodlint checks what TypeScript and ESLint don't: whether your vibe-coded app is ready for production. It runs next to them, not instead of them.

Install

npx prodlint                              # Run directly (no install)

npx prodlint ./my-app # Scan specific path npx prodlint --json # JSON output for CI npx prodlint --sarif # SARIF 2.1.0 for GitHub Code Scanning npx prodlint --summary # Quick pass/fail + top 3 blockers npx prodlint --profile startup # Only critical findings npx prodlint --profile balanced # Warnings and criticals npx prodlint --profile strict # All findings including info (the default) npx prodlint --min-severity warning # Only warnings and criticals npx prodlint --baseline-save .prodlint-baseline.json # Save today's findings npx prodlint --baseline .prodlint-baseline.json # Only findings that aren't in it npx prodlint --ignore "*.test.ts" # Ignore patterns (repeatable) npx prodlint --quiet # Leave out the README badge suggestion npx prodlint --web example.com # Score a deployed site instead (see Site Score)

Or install it:

npm i -D prodlint     # Project dependency

npm i -g prodlint # Global install

Node.js 18 or later.

Exit codes

--min-severity, --profile and --baseline decide which findings are shown, and the exit code follows what's shown. Scores are always worked out from every finding.

JSON output

--json prints one object:

{

"version": "0.10.8", "scannedPath": ".", // the path argument "filesScanned": 6, "scanDurationMs": 39, "findings": [ { "ruleId": "secrets", "file": "lib/stripe.ts", // relative to the scanned path, forward slashes "line": 3, // 1-based "column": 35, // 1-based "message": "Hardcoded Stripe secret key detected", "severity": "critical", // critical | warning | info "category": "security", // security | reliability | performance | ai-quality "fix": "Move the secret to an environment variable and access via process.env.SECRET_NAME" } // one object per finding ], "overallScore": 90, // 0-100, weighted across the categories "categoryScores": [ { "category": "security", "score": 82, "findingCount": 4 } // then reliability, performance, ai-quality ], "summary": { "critical": 3, "warning": 2, "info": 1 } }

fix is there on every finding today, but treat it as optional.

52 Rules across 4 Categories

Each rule has a page with an example and a fix at https://prodlint.com/rules/ .

Security (27 rules)

Reliability (11 rules)

Performance (6 rules)

AI Quality (8 rules)

Smart Detection

prodlint avoids common false positives:

• AST parsing — Babel-based analysis for 15 rules (imports, catch blocks, redirects, redirects in try/catch, SSRF, path traversal, JWT, HTML injection, hydration, transactions, env leaks, loops, SQL, route handlers, server actions) with regex fallback
• Monorepo support — npm/yarn/pnpm workspace dependencies resolved automatically
• Framework awareness — Prisma, Drizzle, Supabase, Knex, and Sequelize whitelists prevent false SQL injection flags
• Middleware detection — Clerk, NextAuth, Supabase middleware (middleware.ts, or proxy.ts on Next.js 16) detected, matcher included — auth findings it covers drop to info
• Block comment awareness — patterns inside /* */ are ignored
• Path alias support — @/, ~/, and tsconfig paths aren't flagged as hallucinated imports
• Route exemptions — auth, webhook, health, and cron routes are skipped where a check wouldn't make sense
• Test and script awareness — most rules skip test files, and a missing package in a test or script is a warning, not critical
• Fix suggestions — every finding comes with a fix hint

Scoring

Each category starts at 100. Deductions per finding:

| Severity | Deduction |