Preflight.sh
A CLI that scans your codebase for launch readiness before you deploy: leaked secrets, security headers, SSL, SEO, broken configs and 72...
Is this your product? Claim it to edit the listing, post updates and answer questions. Prove it with an email address at the product's domain (the listing becomes Claimed), or put the LotsDirectory badge on your website (the listing becomes Verified, and its link to your website is followed while the badge is live).
Description
A CLI that scans your codebase for launch readiness before you deploy: leaked secrets, security headers, SSL, SEO, broken configs and 72 services. Open source, and it never sees your code.
About Preflight.sh
What is Preflight.sh?
Preflight is an open source command-line scan for launch readiness. It runs on the machine or in CI, reads the code only there, and needs no account for the CLI.
What Preflight.sh does
Preflight scans a project for secrets, security headers, SSL, SEO metadata, error pages, legal pages, a favicon, and files such as sitemap.xml and llms.txt. Secrets are reported by file and line, never by value. It also checks variables an env example promises, dependency vulnerabilities, debug statements, and whether known services are wired up. The page says it knows 72 services. Install options on the page are Homebrew, npm, Go, Docker, or a curl script. preflight init detects the stack and writes preflight.yml. preflight scan prints OK, WARN, or FAIL for each check. A scan exits 2 on an error and 1 on warnings only. The optional dashboard keeps a history and writes a fix for a finding. Publishing sends check IDs, statuses, and messages, never file contents or secret values. An agent skill on the page covers Claude Code, Cursor, Codex, OpenCode, and more than 50 other agents.
Who Preflight.sh is for
Developers who want a scan on the machine before deploy, or in CI. Stacks on the page include Next.js, Rails, Laravel, Django, WordPress, and Astro.
How Preflight.sh works
Install Preflight, run preflight init in the project root, and commit preflight.yml. Then run preflight scan. Each check prints OK, WARN, or FAIL, with what it found and how to fix it. Add the scan to CI. It exits 2 when it finds an error and 1 on warnings only, and a json format is available. The CLI needs no account. Create an account only for the dashboard, then authorize with preflight auth login. preflight scan --publish sends a redacted summary. The dashboard can write a step-by-step fix for the detected stack. The page says the two fixes are examples.
Key features
- Scans on the machine report secrets by file and line, never by value.
- Checks for security headers, SSL, variables an env example promises, dependency vulnerabilities, and debug statements.
- SEO metadata, canonical URL, JSON-LD, error pages, legal pages, favicon, robots.txt, sitemap.xml, and llms.txt.
- Service checks include payments, email, analytics, and auth. The page says 72 services.
- preflight init detects the stack for frameworks and CMS tools, including Next.js, Rails, Laravel, WordPress, and Astro.
- CI exit codes: 2 on an error and 1 on warnings only, with a json format.
- An optional dashboard with history and AI fix suggestions. Code stays on the machine.
- An agent skill for Claude Code, Cursor, Codex, OpenCode, and more than 50 other agents. Open source under the MIT license.
Pricing
As listed on preflight.sh, checked 13 October 2026. Prices can change; see the site for current terms.
- Free covers 5 published runs a month. The CLI itself needs no account.
- An OpenAI or Anthropic key in settings keeps publishing free and unlimited. The provider is paid directly.
- Managed is $5 a month for unlimited runs, with no key needed.
Facts from preflight.sh, checked 13 October 2026
- Preflight is open source under the MIT license.
- The about page says Jon C Phillips created and maintains it.
- The captured report is from Preflight 0.22.0. The page says the key is made up, and that the two fixes are examples.
- A check can misread an unusual project. The docs point questions and false positives to an issue on GitHub.
Written from Preflight.sh's own website (Homepage, Features, About, Docs). The maker can claim this listing to edit it.
Categories
Frequently asked questions
Does the code leave the machine?
Scanning runs locally. The page says code never leaves the machine. Publishing sends check IDs, statuses, and messages, never file contents or secret values.
Is an account required?
No for the CLI. Preflight works from the command line with no account. The dashboard at app.preflight.sh is optional and keeps a history of runs and AI fix suggestions.
What do the scan exit codes mean?
A scan that finds only warnings exits 1. A scan that finds an error exits 2. The docs say a CI step then fails when it should. A json format is available for a script.
What does the dashboard cost?
Free covers 5 published runs a month. An OpenAI or Anthropic key keeps publishing free and unlimited, and the provider is paid directly. Managed is $5 a month for unlimited runs and no key needed.
Who maintains Preflight?
Preflight is open source under the MIT license. It was created and is maintained by Jon C Phillips, described on the about page as a product designer and developer who has been launching web products for over twenty years.