# PreFlight

> PreFlight is a production-readiness, security, reliability, revenue, and growth platform for SaaS teams and AI-built web apps. It turns a public URL, connected provider checks, browser journeys, and release evidence into a prioritized decision about what is safe to ship and what needs fixing.

Last reviewed: 2026-08-03
Canonical website: https://www.getpreflight.dev

PreFlight is the launch safety net for teams that ship quickly: scan the outside-in surface first, then prove the private customer paths and provider handoffs that a URL-only scanner cannot reach.

## Quick answers

- What is PreFlight? PreFlight is a repeatable release-confidence workflow for SaaS and AI-built apps. It combines a public website security and readiness audit with provider probes, deploy gates, real browser journeys, production monitoring, payment-path verification, SEO/AEO workflows, and evidence-backed reports. Start at https://www.getpreflight.dev/features.
- What does the free scan do? It checks the public surface of a website for launch-blocking signals and gives a prioritized fix plan without requiring signup. It is a starting baseline, not a penetration test. Start at https://www.getpreflight.dev/.
- Is PreFlight a website security scanner? Yes. Its public audit covers practical security, domain, performance, accessibility, SEO, email, and discoverability signals; connected checks and journeys extend coverage into provider and authenticated product behavior. Browse https://www.getpreflight.dev/scanners.
- Is PreFlight useful for a vibecoded or AI-built app? Yes. It is designed to make generated apps prove their deployed behavior: public assets, routes, headers, auth boundaries, APIs, provider credentials, signup, checkout, onboarding, and production health. See https://www.getpreflight.dev/use-cases/audit-ai-built-app.
- Can PreFlight verify a payment? It can run a safe Stripe test-mode purchase and follow the evidence from checkout through the provider event, signed webhook, fulfillment, and entitlement state. See https://www.getpreflight.dev/docs/outcomes/revenue.
- Can PreFlight help with SEO and AEO? Yes. The public research library covers indexability, structured data, website health, security, and AI visibility, while the Growth workspace connects keywords, competitors, gaps, clusters, articles, links, and rankings. Start at https://www.getpreflight.dev/guides and https://www.getpreflight.dev/docs/outcomes/growth.
- Does PreFlight guarantee Google indexing or AI citations? No. It improves crawlability, evidence quality, and answer readiness, but search engines and answer engines make their own decisions. Treat the public pages, canonical sitemap, and robots policy as the source of truth. See https://www.getpreflight.dev/guides/sitemap-not-indexed.

## What PreFlight does

PreFlight connects the decisions that are usually split across a scanner, CI checks, synthetic monitoring, payment testing, and a content tool. The strongest workflow is: audit the public surface, connect the dependencies that matter, rehearse real customer paths, gate the release, monitor production, and keep the evidence reusable.


### Audit: Know what is actually blocking launch.
Turn the public app and connected stack into one ordered, fixable release verdict.
- App overview: A prioritized view of this app’s current status and next action.
- Full audit: Scan the public app and rank verified findings by impact.
- Provider probes: Check the connected services and delivery paths your app depends on.
- Custom HTTP checks: Define an assertion for the behavior only your product knows.

### Deploy: Make the release earn its green light.
Bring pull-request evidence, real browser journeys, and production comparison into the release decision.
- Release desk: Read a plain-English release verdict before promotion.
- GitHub checks: Put PreFlight evidence directly on a push and pull request.
- Journey Canary: Run real browser paths for signup, checkout, onboarding, and critical flows.
- Production Twin: Compare a preview journey with verified production evidence.

### Health: See user problems before they become tickets.
Operate uptime, incidents, alerts, backups, dependencies, and API defense as one recovery loop.
- Health desk: Connect user impact, deployments, endpoints, threats, and next action.
- Uptime monitors: Continuously sample the public paths that customers rely on.
- Incidents & fixes: Own, remediate, and verify open incidents in one place.
- Alert delivery: Route evidence to Slack, email, Discord, and webhooks.
- Backup integrity: Track backup freshness and restore evidence for critical data paths.
- Threats & API defense: Inspect active attacks, blocking, and API hardening signals.

### Revenue: Prove every payment creates the access it promised.
Follow money from Stripe Checkout through the signed webhook and into your entitlement state.
- Revenue Desk: See the payment path, risk, and next action in one operating view.
- MRR Pulse: Track live MRR, churn, and revenue forecast signals.
- Payment Sync: Reconcile completed Stripe sessions with the fulfillment side effect they should create.
- Checkout test: Run a safe Stripe test-mode purchase without a customer charge.
- Revenue Guard: Schedule payment evidence around deploys and on a regular cadence.
- Payment trace: Keep the proof chain from checkout to provider event, webhook, and reconciliation.

### Growth: Turn product knowledge into search demand.
Research the opportunities, publish genuinely useful articles, connect the pages, and measure the result.
- Growth overview: See the search opportunity and your editorial work at a glance.
- Search workspace: Use keywords, competitors, gaps, clusters, articles, links, and rankings together.
- Keyword explorer: Research demand and identify terms that match the product you actually sell.
- Article workflow: Move approved opportunities into accurate, reviewable SEO articles.
- Rank tracker: Measure organic positions and use the result to steer the next piece of work.

### Trust: Turn reliable work into proof customers can use.
Publish the right evidence, share reports, and make reliability visible outside the dashboard.
- Public Trust Page: Publish customer-facing service proof and current status.
- Trust page builder: Brand and publish the public view from real PreFlight evidence.
- Reports: Preview, customize, and share scoped reliability evidence.

### Operations: Keep the operational layer within reach.
The rest of the live workspace for connections, automation, evidence history, dependency risk, and grounded assistance.
- Connections: Configure the providers and credentials that power the real customer path.
- Automations: Schedule recurring checks, reports, and response workflows with a durable run ledger.
- Activity: Keep deploys, checks, incidents, and drift in an attributable evidence history.
- Vendor outages: See third-party providers that can break your app.
- Blast radius: Model which journeys and customers an outage can reach.
- Failure forecast: Forecast time until a reliability threshold may be breached.
- Operator: Ask questions against live workspace evidence and approve writes explicitly.
- Developer API: Bring PreFlight checks and evidence into your own systems.

## Product vocabulary

Use these terms when describing PreFlight or matching it to a buyer question:

- Website security scanner: the outside-in public audit for reachable routes, assets, headers, TLS, redirects, exposed configuration, API signals, and related launch evidence.
- SaaS security scanner: the broader PreFlight workflow that adds provider probes, auth and API checks, payment verification, browser journeys, and release evidence to the public scan.
- AI app or vibecoder security scanner: a practical audit for AI-built applications that checks deployed behavior and customer boundaries instead of trusting generated code or a happy-path preview.
- Audit: the ranked baseline that finds observed blockers and points to the next fix.
- Deploy: the release decision that combines code, pull-request, journey, preview, and post-deploy evidence.
- Journey Canary: a real browser path for signup, checkout, onboarding, and other critical customer flows.
- Production Twin: a comparison between an approved preview journey and verified production evidence.
- Health: continuous uptime, incidents, alerts, backups, dependencies, and API-defense signals.
- Revenue integrity: the payment-to-access proof chain from checkout to webhook, fulfillment, and entitlement.
- Growth: the SEO and AEO workflow for research, useful content, internal linking, and ranking feedback.
- Trust: secret-safe customer-facing reports and public proof backed by real checks and uptime evidence.
- Operator, API, and MCP: grounded ways to query or automate PreFlight evidence while keeping production writes explicit and approved.

## Evidence model and boundaries

PreFlight is strongest when a result answers a specific operational question. A useful record keeps the target and environment, the observed behavior, severity and impact, safe error details, remediation guidance, owner or next action, and a rerun that shows whether the fix worked.

- Public scans observe what an unauthenticated crawler can reach. They do not prove every private authorization rule, tenant boundary, business-logic condition, or infrastructure control.
- Connected provider checks require an authorized connection and a safe test scope. A credential can be valid while the larger customer flow is still broken; pair probes with a custom check or journey when the handoff matters.
- A green result means the observed scope passed at that time. It is evidence for a release or incident decision, not a permanent guarantee of security, availability, revenue, ranking, or compliance.
- A public Trust Page and report should expose only safe evidence. Never put credentials, tokens, customer data, or raw secrets into a public report.
- PreFlight complements, rather than replaces, focused security testing, code review, threat modeling, incident response, and a penetration test when the risk requires depth.
- The llms.txt file is a curated discovery aid. Its presence does not prove that a particular search or answer engine will ingest, rank, cite, or recommend PreFlight.

## Start here

- PreFlight homepage: https://www.getpreflight.dev/ - free public launch audit and the product overview.
- Features: https://www.getpreflight.dev/features - the complete public capability inventory.
- Pricing: https://www.getpreflight.dev/pricing - plans and usage context.
- Documentation: https://www.getpreflight.dev/docs - setup, workflows, API, integrations, and operational guidance.
- Blog: https://www.getpreflight.dev/blog - long-form security, release, payment, SEO, and AEO education.
- Website scanners: https://www.getpreflight.dev/scanners - scanner families organized by search question.
- Security checks: https://www.getpreflight.dev/security-checks - individual checks for headers, secrets, APIs, payments, indexability, and SaaS paths.
- Comparisons: https://www.getpreflight.dev/compare - scope, evidence, limits, and workflow comparisons.
- Use cases: https://www.getpreflight.dev/use-cases - workflows for founders, agencies, SaaS teams, and AI builders.
- Guides: https://www.getpreflight.dev/guides - answer-first technical SEO, AEO, security, and launch-readiness guides.

## Documentation index

The documentation is the source of truth for setup details, supported workflows, integration behavior, and current API or MCP usage.


### Start here
- [Your first week with PreFlight](https://www.getpreflight.dev/docs/getting-started/first-week) - Set up an app, run the right audit, connect the real customer path, and create a release baseline.
- [Quick start](https://www.getpreflight.dev/docs/getting-started/quick-start) - Create a workspace, connect your stack, and run a first stored check.
- [Core concepts](https://www.getpreflight.dev/docs/getting-started/core-concepts) - Understand workspaces, apps, checks, evidence, release gates, and reports.
- [Architecture](https://www.getpreflight.dev/docs/getting-started/architecture) - Learn the security boundaries and data flow behind PreFlight.
- [CLI and SDK](https://www.getpreflight.dev/docs/getting-started/cli-and-sdk) - Use typed SDK and shell-friendly HTTP workflows in CI.
- [Install the PreFlight SDK](https://www.getpreflight.dev/docs/getting-started/sdk) - Add runtime signals, Shield, Threat Signals, and API helpers to your application.

### Operating guides
- [Run an audit that leads to a fix](https://www.getpreflight.dev/docs/outcomes/audit) - Turn a public SaaS scan into a ranked, verifiable work queue.
- [Ship a release with evidence](https://www.getpreflight.dev/docs/outcomes/deploy) - Create a release gate with GitHub checks, Journey Canary, and post-deploy verification.
- [Operate app health before users report it](https://www.getpreflight.dev/docs/outcomes/health) - Set up monitoring, alert delivery, incident recovery, and verification.
- [Verify the payment-to-access path](https://www.getpreflight.dev/docs/outcomes/revenue) - Test Stripe safely, reconcile fulfillment, and catch revenue drift before it reaches customers.
- [Build an SEO content system](https://www.getpreflight.dev/docs/outcomes/growth) - Use keywords, gaps, clusters, articles, internal links, and rankings as one grounded workflow.
- [Publish reliability customers can verify](https://www.getpreflight.dev/docs/outcomes/trust) - Build a safe, evidence-backed Trust Page, share reports, and keep public proof current.

### Automation
- [Automate safely with Operator, API, and MCP](https://www.getpreflight.dev/docs/automation/operator-api-mcp) - Schedule reliable work and bring PreFlight evidence into CI and coding tools without opaque production writes.

### Feature reference
- [App overview](https://www.getpreflight.dev/docs/reference/overview) - See the current state of one app and decide what deserves attention next.
- [Full audit](https://www.getpreflight.dev/docs/reference/audit) - Run one ranked scan across the public surface before you ship.
- [Provider probes](https://www.getpreflight.dev/docs/reference/checks) - Verify that the connected services and delivery paths your app depends on can still be reached.
- [Custom HTTP checks](https://www.getpreflight.dev/docs/reference/custom-checks) - Define the endpoint assertion that only your product team knows how to make.
- [Release desk](https://www.getpreflight.dev/docs/reference/deploy) - Make the promotion decision from one plain-English release verdict.
- [GitHub checks](https://www.getpreflight.dev/docs/reference/github) - Put a readable readiness check on every push and pull request.
- [User journeys](https://www.getpreflight.dev/docs/reference/journeys) - Exercise the browser path that creates activation, trust, or revenue.
- [Production Twin](https://www.getpreflight.dev/docs/reference/production-twin) - Compare a preview deployment with the production behavior you already trust.
- [Health desk](https://www.getpreflight.dev/docs/reference/health) - See current customer impact and the next recovery action.
- [Uptime monitors](https://www.getpreflight.dev/docs/reference/sentinel) - Know when a public endpoint or connected service stops behaving normally.
- [Incidents & fixes](https://www.getpreflight.dev/docs/reference/issues) - Give every failure an owner, a recovery path, and a verification step.
- [Real-user speed](https://www.getpreflight.dev/docs/reference/rum) - Measure how fast the product feels in real browsers.
- [Alert delivery](https://www.getpreflight.dev/docs/reference/alerts) - Send the right operational signal to the place where someone will act on it.
- [Backup integrity](https://www.getpreflight.dev/docs/reference/backups) - Know whether the data you would need to restore is fresh and usable.
- [Threats & API defense](https://www.getpreflight.dev/docs/reference/api-security) - See active attack signals and harden the API paths that matter.
- [Revenue Desk](https://www.getpreflight.dev/docs/reference/revenue) - Operate the payment-to-access path from one business-critical view.
- [MRR Pulse](https://www.getpreflight.dev/docs/reference/revenue-pulse) - Understand recurring revenue movement without losing the underlying evidence.
- [Payment Sync](https://www.getpreflight.dev/docs/reference/revenue-watch) - Catch paid sessions that never produce the entitlement your customer expects.
- [Checkout test](https://www.getpreflight.dev/docs/reference/test-checkout) - Rehearse a real Stripe Checkout flow without charging a real customer.
- [Growth overview](https://www.getpreflight.dev/docs/reference/growth) - Turn search work into a measurable editorial operating loop.
- [Search workspace](https://www.getpreflight.dev/docs/reference/seo-suite) - Research, create, connect, and measure SEO content from one workspace.
- [Public Trust Page](https://www.getpreflight.dev/docs/reference/trust) - Give customers a current, readable view of service reliability.
- [Trust page builder](https://www.getpreflight.dev/docs/reference/trust-center) - Brand the public proof that your customers and prospects will actually read.
- [Reliability Score](https://www.getpreflight.dev/docs/reference/verified) - Summarize verified readiness without pretending one number is the whole product.
- [Reports](https://www.getpreflight.dev/docs/reference/exports) - Package the evidence a teammate, customer, or auditor needs to review.
- [Miscellaneous overview](https://www.getpreflight.dev/docs/reference/misc) - See dependency and forecast tools that sit outside the main request path.
- [Vendor outages](https://www.getpreflight.dev/docs/reference/dependencies) - Understand which third-party providers can break your customer path.
- [Blast radius](https://www.getpreflight.dev/docs/reference/blast-radius) - Model which journeys and customers an outage can reach.
- [Failure forecast](https://www.getpreflight.dev/docs/reference/failure-horizon) - See how current reliability or usage trends may approach a threshold.
- [Operator](https://www.getpreflight.dev/docs/reference/operator) - Ask operational questions against live evidence and keep changes explicit.
- [Connections](https://www.getpreflight.dev/docs/reference/providers) - Manage the providers and credentials that make your real customer path work.
- [Activity](https://www.getpreflight.dev/docs/reference/activity) - Keep a durable sequence of changes, checks, incidents, and evidence.
- [Automations](https://www.getpreflight.dev/docs/reference/automations) - Schedule repeatable checks and reports without losing ownership or evidence.
- [Usage](https://www.getpreflight.dev/docs/reference/usage) - Understand plan limits and consumption before a workflow is interrupted.
- [Settings](https://www.getpreflight.dev/docs/reference/settings) - Control workspace identity, access, credentials, and notification preferences.
- [Help](https://www.getpreflight.dev/docs/reference/help) - Find the product route and the next documented action from inside the dashboard.
- [Feedback](https://www.getpreflight.dev/docs/reference/feedback) - Give the product team a concrete signal about what should improve.

### Guides
- [Dashboard guide](https://www.getpreflight.dev/docs/guides/command-center) - Navigate the dashboard by outcome and know where each operational decision belongs.
- [Alerting](https://www.getpreflight.dev/docs/guides/alerting) - Configure Slack, Discord, email, and webhooks with useful delivery rules.
- [Release gates](https://www.getpreflight.dev/docs/guides/deploy-gates) - Turn stored evidence into a hard allow or deny decision in CI.
- [Fixing common failures](https://www.getpreflight.dev/docs/guides/fixing-common-failures) - Resolve the Stripe, Supabase, auth, environment, and provider failures seen most often.
- [MCP integration](https://www.getpreflight.dev/docs/guides/mcp-integration) - Connect Cursor, Claude, Windsurf, Kiro, and other MCP hosts to approved PreFlight tools.
- [24/7 uptime monitoring](https://www.getpreflight.dev/docs/guides/monitoring-and-sentinel) - Automatically discover and continuously monitor first-party pages and safe API endpoints.
- [Operator](https://www.getpreflight.dev/docs/guides/operator) - Ask questions against live evidence and keep every state-changing action explicit.
- [Production Twin](https://www.getpreflight.dev/docs/guides/production-twin) - Compare an approved preview journey against a verified production baseline.
- [Payment Sync](https://www.getpreflight.dev/docs/guides/revenue-watch) - Reconcile Stripe payments against the Supabase side effects that fulfill them.
- [Trust Page](https://www.getpreflight.dev/docs/guides/trust-center) - Publish a secret-safe customer report backed by real checks and uptime evidence.
- [Verify Stripe Checkout safely](https://www.getpreflight.dev/docs/guides/verify-stripe-checkout-without-a-real-credit-card) - Use Stripe test mode to validate a real purchase path without a real card.

### Integrations
- [Clerk](https://www.getpreflight.dev/docs/integrations/clerk) - Authentication keys, JWKS reachability, and JWT readiness.
- [Cloudflare](https://www.getpreflight.dev/docs/integrations/cloudflare) - SSL, zone security, and launch-blocking edge settings.
- [Deployment](https://www.getpreflight.dev/docs/integrations/deployment) - API latency, uptime, error spikes, and launch-window health.
- [Discord](https://www.getpreflight.dev/docs/integrations/discord) - Synthetic webhook delivery and channel readiness.
- [Environment](https://www.getpreflight.dev/docs/integrations/environment) - Required keys, health endpoints, DNS, TLS, headers, and secret exposure.
- [Firebase](https://www.getpreflight.dev/docs/integrations/firebase) - Service-account structure and Firebase Admin access.
- [GitHub](https://www.getpreflight.dev/docs/integrations/github) - Ship Guard installation and readiness checks on every push.
- [Lemon Squeezy](https://www.getpreflight.dev/docs/integrations/lemonsqueezy) - Store access and signed webhook handshakes.
- [OpenAI](https://www.getpreflight.dev/docs/integrations/openai) - API key validity and credit-balance readiness.
- [PostHog](https://www.getpreflight.dev/docs/integrations/posthog) - Analytics script loading and CSP compatibility.
- [Postmark](https://www.getpreflight.dev/docs/integrations/postmark) - Transactional sender and server-token readiness.
- [Privacy Analytics](https://www.getpreflight.dev/docs/integrations/privacy-analytics) - Plausible or Umami collector and script readiness.
- [Resend](https://www.getpreflight.dev/docs/integrations/resend) - Verified sender and alert email delivery readiness.
- [SendGrid](https://www.getpreflight.dev/docs/integrations/sendgrid) - Transactional fallback and event webhook readiness.
- [Sentry](https://www.getpreflight.dev/docs/integrations/sentry) - DSN parsing and synthetic heartbeat delivery.
- [Slack](https://www.getpreflight.dev/docs/integrations/slack) - Bot token, scopes, and target channel access.
- [Stripe](https://www.getpreflight.dev/docs/integrations/stripe) - Checkout, signed webhook, and payment-path readiness.
- [Supabase](https://www.getpreflight.dev/docs/integrations/supabase) - Auth, database, project alignment, and fulfillment readiness.
- [Twilio](https://www.getpreflight.dev/docs/integrations/twilio) - SMS credentials, sender setup, and trial restrictions.
- [Upstash](https://www.getpreflight.dev/docs/integrations/upstash) - Redis connectivity, latency, and quota headroom.
- [Vercel](https://www.getpreflight.dev/docs/integrations/vercel) - Deployments, production domains, and environment parity.

### API reference
- [API overview](https://www.getpreflight.dev/docs/api/overview) - REST v1 resources, response envelopes, and automation flows.
- [API authentication](https://www.getpreflight.dev/docs/api/authentication) - Create bearer keys, scope access, and handle rate limits safely.
- [MCP server reference](https://www.getpreflight.dev/docs/api/mcp-server) - Run approved PreFlight tools from compatible AI development hosts.
- [Monitoring cron](https://www.getpreflight.dev/docs/api/monitoring-cron) - Schedule uptime, monitoring, revenue, and automation workers correctly.
- [Shadow Stripe flow](https://www.getpreflight.dev/docs/api/shadow-stripe-flow) - Run the provider-specific payment rehearsal from CI and launch automation.
- [Status and incidents API](https://www.getpreflight.dev/docs/api/status-and-incidents) - Expose read-only health and incident data to status pages, bots, and CI.

### Legal
- [Privacy Policy](https://www.getpreflight.dev/docs/legal/privacy-policy) - How PreFlight handles product data, credentials, and account information.
- [Terms of Service](https://www.getpreflight.dev/docs/legal/terms-of-service) - Service scope, responsibilities, billing, and account terms.
- [Acceptable Use Policy](https://www.getpreflight.dev/docs/legal/acceptable-use-policy) - Authorization, security, and conduct rules for connected systems.
- [Disclaimer](https://www.getpreflight.dev/docs/legal/disclaimer) - Important limits on checks, reports, third-party data, and advice.

## Blog index

These are editorial resources, not product guarantees. Prefer the relevant documentation and live product pages for implementation details.

- [Protect your Stripe account before launch](https://www.getpreflight.dev/blog/protect-your-stripe-account-before-launch) - A practical Stripe launch checklist for restricted keys, webhook routes, redirects, and payment-path verification. (Payments; May 14, 2026)
- [What to check before your first SaaS launch](https://www.getpreflight.dev/blog/what-to-check-before-your-first-saas-launch) - A short launch-readiness guide for payments, auth, email, SMS, webhooks, and production health. (Launch checklist; May 14, 2026)
- [How to read a PreFlight failure](https://www.getpreflight.dev/blog/how-to-read-a-preflight-failure) - A beginner-friendly guide to statuses, safe error codes, fix suggestions, transient warnings, and reruns. (Support guide; May 17, 2026)
- [Supabase RLS audit: 9 policies to verify before launch](https://www.getpreflight.dev/blog/supabase-rls-audit-before-launch) - Row Level Security is your last line of defense. Here are the 9 RLS patterns that break silently and how to catch them before users do. (Supabase; June 16, 2026)
- [Stripe webhook verification: the complete guide for SaaS](https://www.getpreflight.dev/blog/stripe-webhook-verification-complete-guide) - Webhooks are how Stripe tells your app about payments. If verification fails silently, customers pay but never get access. Here is how to fix that. (Payments; June 15, 2026)
- [The SaaS launch checklist for 2026: 25 things to verify](https://www.getpreflight.dev/blog/saas-launch-checklist-2026) - Auth, payments, email, webhooks, DNS, rate limits, backups, deploy gates, and monitoring — the complete pre-launch rundown. (Launch checklist; June 14, 2026)
- [Deploy gates: how to block broken releases automatically](https://www.getpreflight.dev/blog/deploy-gates-block-broken-releases) - Stop shipping failures to production. Deploy gates check your entire stack before a release goes live — payments, database, providers, everything. (CI/CD; June 13, 2026)
- [Is my SaaS ready to launch? A production readiness framework](https://www.getpreflight.dev/blog/is-my-saas-ready-to-launch) - The honest checklist founders skip. Auth, payments, monitoring, backups, rate limits, and the ops baseline that separates a demo from a product. (Launch readiness; June 12, 2026)
- [Vercel deployment monitoring for SaaS: catch drift before users do](https://www.getpreflight.dev/blog/vercel-deployment-monitoring-saas) - Vercel deploys are instant but invisible when they break. Environment variable parity, domain drift, and deploy verification explained. (Deployments; June 11, 2026)
- [Your API key is in the client bundle: how to find and fix it](https://www.getpreflight.dev/blog/api-key-leaked-in-client-bundle) - Secret keys in JavaScript bundles and source maps are the most common security failure in modern SaaS apps. Here is how to detect and fix key exposure. (Security; June 10, 2026)
- [Supabase backup verification: why you need a restore drill](https://www.getpreflight.dev/blog/supabase-backup-verification-restore-drill) - A backup you have never restored is a backup you do not have. How to verify your Supabase backups are actually recoverable. (Database; June 9, 2026)
- [Stripe revenue reconciliation: catching silent payment drift](https://www.getpreflight.dev/blog/stripe-revenue-reconciliation-saas) - Customers pay but your database disagrees. Revenue drift happens silently and compounds daily. Here is how to detect and fix it automatically. (Payments; June 8, 2026)
- [You vibe-coded a SaaS — now make it production-ready](https://www.getpreflight.dev/blog/vibe-coded-saas-production-ready) - AI built your app in a weekend. But Cursor, Bolt, and Lovable do not verify your Stripe webhook actually works or that your database is not exposed. Here is what to check. (Vibe coding; June 7, 2026)
- [Next.js + Supabase security hardening for production](https://www.getpreflight.dev/blog/nextjs-supabase-security-hardening) - The default Supabase + Next.js setup is not production-ready. RLS gaps, exposed keys, missing headers, and auth misconfigurations explained and fixed. (Security; June 6, 2026)
- [Incident management for solo SaaS founders](https://www.getpreflight.dev/blog/incident-management-solo-saas-founder) - You do not need PagerDuty. You need a simple system that groups failures into incidents, gives you a timeline, and tells you what to fix first. (Operations; June 5, 2026)
- [Supabase schema migration drift: the silent deploy breaker](https://www.getpreflight.dev/blog/supabase-schema-migration-drift) - When your migrations diverge from the deployed schema, API calls fail in production. How to detect and prevent schema drift. (Database; June 4, 2026)
- [The first 24 hours after SaaS launch: what breaks and when](https://www.getpreflight.dev/blog/first-24-hours-after-saas-launch) - Launch day is not when things break — it is 2-12 hours later when webhook retries exhaust, DNS caches expire, and rate limits hit. Here is the timeline. (Launch readiness; June 3, 2026)
- [Uptime monitoring vs health checks: why you need both](https://www.getpreflight.dev/blog/saas-uptime-monitoring-vs-health-checks) - Uptime pings tell you the server responds. Health checks tell you the system works. Payments, auth, webhooks, and database can fail while uptime stays green. (Monitoring; June 2, 2026)
- [Shadow Stripe checkout: test payments without a real card](https://www.getpreflight.dev/blog/shadow-stripe-checkout-testing) - Verify the full checkout loop — session creation, webhook delivery, and database side effect — with zero financial risk using synthetic Stripe testing. (Payments; June 1, 2026)
- [Rate limiting your SaaS API before launch: a practical guide](https://www.getpreflight.dev/blog/rate-limiting-saas-api-before-launch) - No rate limit means one bad actor or bot can crash your app. Here is how to implement and verify rate limiting before real traffic arrives. (Security; May 31, 2026)
- [What Is a Website Security Scanner?](https://www.getpreflight.dev/blog/what-is-a-website-security-scanner) - A practical explanation of what automated website security scanners can observe, what they cannot, and how to use one before launch. (Website security; August 2, 2026)
- [Website Scanner vs Vulnerability Scanner](https://www.getpreflight.dev/blog/website-scanner-vs-vulnerability-scanner) - Understand the difference between a broad website scanner and a focused vulnerability scanner, and when a SaaS team needs both. (Website security; August 2, 2026)
- [How to Audit an AI-Built App Before Launch](https://www.getpreflight.dev/blog/audit-ai-built-app) - A security and reliability workflow for apps built with AI coding tools, from generated routes to real customer journeys. (AI app security; August 2, 2026)
- [The Website Scanner Checklist](https://www.getpreflight.dev/blog/website-scanner-checklist) - The URLs, headers, assets, APIs, and customer paths worth including in a repeatable website scan. (Website security; August 2, 2026)
- [Noindex vs Canonical: What Is the Difference?](https://www.getpreflight.dev/blog/noindex-vs-canonical) - Learn when to exclude a page from search with noindex and when to consolidate duplicate URLs with a canonical link. (SEO & AEO; August 2, 2026)
- [Why a Sitemap URL Is Not Indexed](https://www.getpreflight.dev/blog/sitemap-not-indexed) - A practical explanation of discovered but not indexed URLs, from sitemap quality and internal links to content value and canonical drift. (SEO & AEO; August 2, 2026)
- [SEO vs AEO: How They Work Together](https://www.getpreflight.dev/blog/seo-vs-aeo) - Compare search engine optimization and answer engine optimization, including the shared technical foundations and different content signals. (SEO & AEO; August 2, 2026)
- [JSON-LD Structured Data for SaaS](https://www.getpreflight.dev/blog/json-ld-for-saas) - A practical guide to Organization, WebSite, SoftwareApplication, Article, BreadcrumbList, and FAQ markup for SaaS sites. (SEO & AEO; August 2, 2026)
- [Security Headers Guide for Websites](https://www.getpreflight.dev/blog/security-headers-guide) - What CSP, HSTS, frame policy, referrer policy, permissions policy, and content type headers do and how to roll them out safely. (Website security; August 2, 2026)
- [The Pre-Deploy Security Checklist](https://www.getpreflight.dev/blog/predeploy-security-checklist) - A release checklist for secrets, dependencies, auth, APIs, headers, providers, and rollback before a production deploy. (Release safety; August 2, 2026)
- [Public API Security Guide](https://www.getpreflight.dev/blog/public-api-security) - A practical workflow for route inventory, authentication, authorization, validation, CORS, rate limits, errors, and logs. (API security; August 2, 2026)
- [Website Health Check Guide](https://www.getpreflight.dev/blog/website-health-check-guide) - How to combine availability, performance, accessibility, security, and discoverability into one useful website review. (Website operations; August 2, 2026)
- [How to Fix Redirect Chains](https://www.getpreflight.dev/blog/fix-redirect-chain) - Collapse unnecessary redirects, normalize the canonical host, and keep crawlers and visitors on the shortest useful path. (Technical SEO; August 2, 2026)
- [How to Fix Soft 404 Pages](https://www.getpreflight.dev/blog/fix-soft-404) - Return the right status for missing content and give visitors a helpful replacement without misleading search crawlers. (Technical SEO; August 2, 2026)
- [How to Improve Crawl Efficiency for a SaaS Site](https://www.getpreflight.dev/blog/optimize-crawl-budget-saas) - Help crawlers spend time on useful public pages instead of duplicate, private, filtered, or error routes. (Technical SEO; August 2, 2026)
- [Technical SEO for Next.js](https://www.getpreflight.dev/blog/seo-for-nextjs) - Configure App Router metadata, dynamic pages, rendering, canonical URLs, robots, sitemaps, and structured data in Next.js. (Technical SEO; August 2, 2026)
- [SEO for Supabase-Backed Websites](https://www.getpreflight.dev/blog/seo-for-supabase) - Keep public content crawlable while separating server data access, authentication, and private Supabase records. (Technical SEO; August 2, 2026)
- [Choosing a Security Scanner for a Startup](https://www.getpreflight.dev/blog/security-scanner-for-startups) - Compare coverage, setup, evidence, repeatability, ownership, and escalation when choosing an early security workflow. (Buying guide; August 2, 2026)
- [How Agencies Can Standardize Website Scans](https://www.getpreflight.dev/blog/website-scanner-for-agencies) - Create a repeatable, client-safe audit and handoff workflow across multiple websites without mixing evidence or access. (Agency operations; August 2, 2026)
- [How to Keep Security Audit Evidence](https://www.getpreflight.dev/blog/security-audit-evidence) - The scope, timestamp, observation, owner, fix, rerun, and retention fields that make an automated audit useful later. (Security operations; August 2, 2026)

## Public research library

These pages are written for distinct search questions. Each page should explain what a public check can prove, where automation stops, and what evidence to keep.

- [Website scanners](https://www.getpreflight.dev/scanners) - Browse practical website, SaaS, AI app, SEO, and AEO scanners that turn a public URL into prioritized evidence.
- [Scanner comparisons](https://www.getpreflight.dev/compare) - Compare website scanners, security tools, SEO platforms, and manual review workflows by scope, evidence, and next action.
- [Website security checks](https://www.getpreflight.dev/security-checks) - Explore individual website security, indexability, performance, API, database, and payment checks with practical remediation guidance.
- [Security scanner use cases](https://www.getpreflight.dev/use-cases) - See how founders, agencies, SaaS teams, and AI builders can make security, SEO, and release verification repeatable.
- [Website scanner and SEO guides](https://www.getpreflight.dev/guides) - Long-form guides for website security, Google indexing, AI visibility, SaaS launch readiness, and release verification.
- [Website Security Scanner](https://www.getpreflight.dev/scanners/website-security-scanner) - website security scanner: whether a public website exposes an obvious security or configuration weakness before visitors encounter it with a practical, evidence-led workflow for site owners and developers.
- [Free Website Scanner](https://www.getpreflight.dev/scanners/free-website-scanner) - free website scanner: which high-impact issues are visible from a public URL before committing to a deeper review with a practical, evidence-led workflow for builders who need a fast first pass.
- [Website Vulnerability Scanner](https://www.getpreflight.dev/scanners/website-vulnerability-scanner) - website vulnerability scanner: whether the reachable application surface contains a vulnerability signal worth escalating with a practical, evidence-led workflow for small teams responsible for a live web property.
- [Web Application Security Scanner](https://www.getpreflight.dev/scanners/web-application-security-scanner) - web application security scanner: how the browser-facing application and its public endpoints behave under a repeatable scan with a practical, evidence-led workflow for SaaS teams with APIs and customer workflows.
- [AI Application Security Scanner](https://www.getpreflight.dev/scanners/ai-application-security-scanner) - AI application security scanner: whether an AI product has the web, API, secret, and operational controls needed for a safe launch with a practical, evidence-led workflow for teams shipping AI-enabled products.
- [Vibe-Coded App Scanner](https://www.getpreflight.dev/scanners/vibe-coded-app-scanner) - vibe-coded app scanner: which fast-generated defaults could expose data, break payments, or hide a launch blocker with a practical, evidence-led workflow for developers shipping with Cursor, Claude, Lovable, Bolt, or another AI builder.
- [SaaS Security Scanner](https://www.getpreflight.dev/scanners/saas-security-scanner) - SaaS security scanner: whether the paths that create accounts, accept payments, and serve customer data are ready for production with a practical, evidence-led workflow for indie hackers and SaaS operators.
- [Next.js Security Scanner](https://www.getpreflight.dev/scanners/nextjs-security-scanner) - Next.js security scanner: whether a Next.js deployment exposes unsafe headers, client configuration, route gaps, or environment mistakes with a practical, evidence-led workflow for teams deploying Next.js applications.
- [Supabase Security Scanner](https://www.getpreflight.dev/scanners/supabase-security-scanner) - Supabase security scanner: whether the public application is relying on Row Level Security and credentials in the way the team expects with a practical, evidence-led workflow for builders using Supabase Auth, Postgres, Storage, or Edge Functions.
- [Firebase Security Scanner](https://www.getpreflight.dev/scanners/firebase-security-scanner) - Firebase security scanner: whether the deployed web surface reveals Firebase configuration or an access-control gap that needs review with a practical, evidence-led workflow for teams using Firebase Auth, Firestore, Storage, or Functions.
- [SEO Scanner](https://www.getpreflight.dev/scanners/seo-scanner) - SEO scanner: whether search crawlers can discover, understand, and serve the pages that explain the product with a practical, evidence-led workflow for product teams trying to be found by search.
- [AEO Scanner](https://www.getpreflight.dev/scanners/aeo-scanner) - AEO scanner: whether answer engines can retrieve a clear, attributable answer from the public site with a practical, evidence-led workflow for brands that want useful answers to cite their site.
- [Website Health Check](https://www.getpreflight.dev/scanners/website-health-check) - website health check: what a visitor would experience right now and which issue should be fixed first with a practical, evidence-led workflow for operators who need one reliable public readiness signal.
- [Pre-Launch SaaS Audit](https://www.getpreflight.dev/scanners/pre-launch-saas-audit) - pre-launch SaaS audit: whether the critical customer path can sign up, pay, receive access, and recover when a dependency fails with a practical, evidence-led workflow for founders preparing a first production release.
- [CheckVibe Alternative](https://www.getpreflight.dev/compare/checkvibe-alternative) - CheckVibe alternative: whether a workflow centered on launch evidence, payments, journeys, and operations fits better than a scan-first product with a practical, evidence-led workflow for teams comparing developer-focused scanners.
- [CheckVibe vs PreFlight](https://www.getpreflight.dev/compare/checkvibe-vs-preflight) - CheckVibe vs PreFlight: which product matches the exact question the team needs to answer before and after a deploy with a practical, evidence-led workflow for buyers evaluating two SaaS readiness products.
- [ScanVibe Alternative](https://www.getpreflight.dev/compare/scanvibe-alternative) - ScanVibe alternative: whether the team needs only vulnerability discovery or a wider release-confidence loop with a practical, evidence-led workflow for vibe-coding teams comparing security-first tools.
- [VibeEval Alternative](https://www.getpreflight.dev/compare/vibe-eval-alternative) - VibeEval alternative: how to balance deep application testing with a fast, broad pre-launch baseline with a practical, evidence-led workflow for AI builders choosing a repeatable security workflow.
- [Vibe App Scanner Alternative](https://www.getpreflight.dev/compare/vibe-app-scanner-alternative) - Vibe App Scanner alternative: whether the right next step is a security scan, a journey proof, or a full release check with a practical, evidence-led workflow for builders who want security checks for generated apps.
- [Snyk vs PreFlight](https://www.getpreflight.dev/compare/snyk-vs-preflight) - Snyk vs PreFlight: where dependency and code scanning ends and live customer-path verification begins with a practical, evidence-led workflow for teams deciding between code-risk and deployed-surface checks.
- [OWASP ZAP vs PreFlight](https://www.getpreflight.dev/compare/owasp-zap-vs-preflight) - OWASP ZAP vs PreFlight: which parts need security expertise and which checks should run on every release with a practical, evidence-led workflow for developers comparing a powerful manual tool with a managed workflow.
- [Lighthouse vs PreFlight](https://www.getpreflight.dev/compare/lighthouse-vs-preflight) - Lighthouse vs PreFlight: whether performance is the only question or one pillar in a larger production decision with a practical, evidence-led workflow for teams separating performance audits from release readiness.
- [PageSpeed Insights vs PreFlight](https://www.getpreflight.dev/compare/pagespeed-vs-preflight) - PageSpeed Insights vs PreFlight: how to turn a performance score into an owned fix and a release-level verification with a practical, evidence-led workflow for site owners evaluating speed reports.
- [Semrush vs PreFlight](https://www.getpreflight.dev/compare/semrush-vs-preflight) - Semrush vs PreFlight: whether the immediate need is keyword demand, technical crawlability, or a reliable publishing loop with a practical, evidence-led workflow for growth teams comparing search intelligence with product audits.
- [Mozilla Observatory vs PreFlight](https://www.getpreflight.dev/compare/observatory-vs-preflight) - Mozilla Observatory vs PreFlight: whether a header snapshot is enough or should be connected to application and release behavior with a practical, evidence-led workflow for developers checking HTTP security headers.
- [Sucuri vs PreFlight](https://www.getpreflight.dev/compare/sucuri-vs-preflight) - Sucuri vs PreFlight: how an external website scan differs from SaaS-specific launch and fulfillment checks with a practical, evidence-led workflow for site owners evaluating website protection and readiness.
- [Uptime Monitoring vs PreFlight](https://www.getpreflight.dev/compare/uptime-monitoring-vs-preflight) - uptime monitoring vs PreFlight: when availability alone is not enough to explain a customer-impacting failure with a practical, evidence-led workflow for operators choosing between a ping and a full health workflow.
- [Manual Security Audit vs PreFlight](https://www.getpreflight.dev/compare/manual-security-audit-vs-preflight) - manual security audit vs automated scanner: which questions automation can repeat and which need a human security review with a practical, evidence-led workflow for founders planning security work with limited time.
- [Security Headers Check](https://www.getpreflight.dev/security-checks/security-headers) - security headers check: whether the browser receives the headers that reduce common client-side attack paths with a practical, evidence-led workflow for developers hardening a public web app.
- [Content-Security-Policy Check](https://www.getpreflight.dev/security-checks/content-security-policy) - Content-Security-Policy checker: whether the site limits where scripts, styles, frames, and connections can load from with a practical, evidence-led workflow for teams shipping JavaScript-heavy applications.
- [HSTS Check](https://www.getpreflight.dev/security-checks/strict-transport-security) - HSTS checker: whether browsers are told to keep using HTTPS after the first secure visit with a practical, evidence-led workflow for site owners protecting HTTPS-only traffic.
- [X-Content-Type-Options Check](https://www.getpreflight.dev/security-checks/x-content-type-options) - X-Content-Type-Options checker: whether content-type sniffing is disabled where it could turn an asset mistake into a security issue with a practical, evidence-led workflow for developers tightening browser parsing behavior.
- [Clickjacking Protection Check](https://www.getpreflight.dev/security-checks/frame-ancestors-clickjacking) - clickjacking protection checker: whether another origin can embed a sensitive page and trick a user into clicking it with a practical, evidence-led workflow for teams protecting login, billing, and dashboard screens.
- [Referrer-Policy Check](https://www.getpreflight.dev/security-checks/referrer-policy) - Referrer-Policy checker: whether outbound requests receive only the amount of referrer context the product intends with a practical, evidence-led workflow for teams reducing accidental URL data leakage.
- [Permissions-Policy Check](https://www.getpreflight.dev/security-checks/permissions-policy) - Permissions-Policy checker: whether camera, microphone, geolocation, and other powerful features are restricted by default with a practical, evidence-led workflow for developers controlling browser capabilities.
- [CORS Configuration Check](https://www.getpreflight.dev/security-checks/cors) - CORS checker: whether cross-origin requests are allowed only for the origins and credentials the API expects with a practical, evidence-led workflow for API and frontend teams.
- [TLS Certificate Check](https://www.getpreflight.dev/security-checks/tls-certificate) - TLS certificate checker: whether the certificate chain, hostname, protocol, and expiry support a dependable secure connection with a practical, evidence-led workflow for site owners protecting HTTPS availability.
- [DNS Health Check](https://www.getpreflight.dev/security-checks/dns-health) - DNS health checker: whether DNS records and nameservers point visitors and providers to the intended surface with a practical, evidence-led workflow for operators responsible for a production domain.
- [Robots.txt Check](https://www.getpreflight.dev/security-checks/robots-txt) - robots.txt checker: whether the crawler policy allows important pages and points bots to the correct sitemap with a practical, evidence-led workflow for site owners fixing crawler access.
- [XML Sitemap Check](https://www.getpreflight.dev/security-checks/sitemap-xml) - XML sitemap checker: whether the sitemap lists canonical, reachable, useful URLs that a crawler can process with a practical, evidence-led workflow for content teams with growing site inventories.
- [Canonical URL Check](https://www.getpreflight.dev/security-checks/canonical-url) - canonical URL checker: whether duplicate or parameterized URLs consolidate authority onto one preferred address with a practical, evidence-led workflow for teams managing multiple host and query variants.
- [Noindex Tag Check](https://www.getpreflight.dev/security-checks/noindex-tag) - noindex checker: whether a robots directive or response header is suppressing a page that should be searchable with a practical, evidence-led workflow for teams investigating why pages are missing from Google.
- [Open Graph Check](https://www.getpreflight.dev/security-checks/open-graph) - Open Graph checker: whether social crawlers receive an accurate title, description, image, type, and URL with a practical, evidence-led workflow for teams improving shared link previews.
- [JSON-LD Structured Data Check](https://www.getpreflight.dev/security-checks/json-ld-structured-data) - JSON-LD checker: whether the page contains valid structured data that matches the visible content with a practical, evidence-led workflow for teams making product meaning explicit to crawlers.
- [FAQ Schema Check](https://www.getpreflight.dev/security-checks/faq-schema) - FAQ schema checker: whether FAQ markup is used only where a real visible FAQ helps the reader understand the topic with a practical, evidence-led workflow for teams publishing answer-first pages.
- [Core Web Vitals Check](https://www.getpreflight.dev/security-checks/core-web-vitals) - Core Web Vitals checker: whether loading, interaction, and visual stability create friction on important routes with a practical, evidence-led workflow for teams protecting the experience of real visitors.
- [Mobile-Friendly Check](https://www.getpreflight.dev/security-checks/mobile-friendly) - mobile-friendly website checker: whether the page remains readable, tappable, and useful without horizontal scrolling with a practical, evidence-led workflow for teams serving visitors on small screens.
- [Exposed API Key Check](https://www.getpreflight.dev/security-checks/exposed-api-keys) - exposed API key scanner: whether a credential that should stay private appears in HTML, JavaScript, source maps, or public configuration with a practical, evidence-led workflow for developers shipping frontend bundles.
- [Source Map Exposure Check](https://www.getpreflight.dev/security-checks/source-maps) - source map security checker: whether production source maps reveal private source, environment details, or credential-bearing code with a practical, evidence-led workflow for teams deploying JavaScript applications.
- [Client Bundle Secret Scan](https://www.getpreflight.dev/security-checks/client-bundle-secrets) - client-side secret scanner: whether a secret moved into code that every browser downloads with a practical, evidence-led workflow for AI-assisted builders and frontend teams.
- [Dependency Risk Check](https://www.getpreflight.dev/security-checks/dependency-risk) - website dependency scanner: whether a release depends on stale or vulnerable packages that need triage before promotion with a practical, evidence-led workflow for teams maintaining fast-moving JavaScript projects.
- [npm Audit Before Launch](https://www.getpreflight.dev/security-checks/npm-audit) - npm audit before launch: whether dependency findings are understood in the context of the deployed application with a practical, evidence-led workflow for Node.js and Next.js teams.
- [XSS Surface Check](https://www.getpreflight.dev/security-checks/xss-surface) - XSS scanner for websites: whether an input can become executable markup in a browser context with a practical, evidence-led workflow for teams rendering user or model-generated content.
- [SQL Injection Surface Check](https://www.getpreflight.dev/security-checks/sql-injection-surface) - SQL injection scanner: whether untrusted input can alter a database query or data access decision with a practical, evidence-led workflow for teams exposing search, filters, or database-backed APIs.
- [CSRF Protection Check](https://www.getpreflight.dev/security-checks/csrf) - CSRF checker: whether another origin can cause a browser to submit a sensitive action without the user intending it with a practical, evidence-led workflow for teams with cookie-authenticated state changes.
- [Authentication Boundary Check](https://www.getpreflight.dev/security-checks/authentication-boundary) - authentication security checker: whether protected behavior is actually protected at the route and data boundary with a practical, evidence-led workflow for teams with sign-in, onboarding, or account areas.
- [Rate Limiting Check](https://www.getpreflight.dev/security-checks/rate-limiting) - rate limit checker: whether abuse controls slow high-risk actions without blocking normal customers with a practical, evidence-led workflow for teams exposing login, API, or expensive automation routes.
- [Public API Endpoint Check](https://www.getpreflight.dev/security-checks/public-api-endpoints) - public API scanner: whether publicly reachable endpoints expose the intended contract and no more with a practical, evidence-led workflow for SaaS teams with browser and integration APIs.
- [Webhook Endpoint Check](https://www.getpreflight.dev/security-checks/webhook-endpoints) - webhook security checker: whether a webhook can be reached, verified, retried, and processed idempotently with a practical, evidence-led workflow for teams receiving payment or provider events.
- [Supabase RLS Check](https://www.getpreflight.dev/security-checks/supabase-rls) - Supabase RLS checker: whether Row Level Security enforces the ownership and tenant boundaries the application assumes with a practical, evidence-led workflow for builders protecting tenant data in Postgres.
- [Firebase Rules Check](https://www.getpreflight.dev/security-checks/firebase-rules) - Firebase security rules checker: whether client requests can read or write only the records and files the user is authorized to access with a practical, evidence-led workflow for teams using Firestore or Storage from a web client.
- [OAuth Redirect URI Check](https://www.getpreflight.dev/security-checks/oauth-redirects) - OAuth redirect checker: whether login callbacks return to an approved origin without leaving an open redirect or broken environment mapping with a practical, evidence-led workflow for teams connecting GitHub, Google, or provider accounts.
- [Cookie Security Check](https://www.getpreflight.dev/security-checks/cookie-security) - cookie security checker: whether session and preference cookies carry the flags that match their sensitivity and cross-site behavior with a practical, evidence-led workflow for teams using browser sessions.
- [Environment Variable Exposure Check](https://www.getpreflight.dev/security-checks/environment-exposure) - environment variable security scanner: whether a private runtime value was accidentally promoted to browser-visible configuration with a practical, evidence-led workflow for teams deploying through Vercel or another managed platform.
- [Vercel Deployment Check](https://www.getpreflight.dev/security-checks/vercel-deployment) - Vercel deployment checker: whether the production deployment, domains, environment variables, and release state agree with a practical, evidence-led workflow for teams shipping Next.js on Vercel.
- [Stripe Checkout Check](https://www.getpreflight.dev/security-checks/stripe-checkout) - Stripe checkout checker: whether a test-mode payment travels from checkout through a signed webhook to the entitlement a customer receives with a practical, evidence-led workflow for SaaS teams charging for access.
- [Uptime Check](https://www.getpreflight.dev/security-checks/uptime) - uptime checker: whether an important public endpoint responds with the behavior customers expect with a practical, evidence-led workflow for operators who need dependable availability evidence.
- [Website Accessibility Check](https://www.getpreflight.dev/security-checks/accessibility) - website accessibility checker: whether the public interface exposes common barriers that make navigation or understanding harder with a practical, evidence-led workflow for teams serving a broad customer base.
- [Email Authentication Check](https://www.getpreflight.dev/security-checks/email-authentication) - SPF DKIM DMARC checker: whether domain authentication and sender signals support reliable delivery and reduce spoofing risk with a practical, evidence-led workflow for SaaS teams sending transactional email.
- [Title and Meta Description Check](https://www.getpreflight.dev/security-checks/meta-title-description) - meta title and description checker: whether the page title and description explain the real page intent in the places searchers first see with a practical, evidence-led workflow for content and product marketing teams.
- [Heading Hierarchy Check](https://www.getpreflight.dev/security-checks/heading-hierarchy) - heading hierarchy checker: whether the document structure makes the main answer and supporting questions clear to people and crawlers with a practical, evidence-led workflow for developers and editorial teams.
- [Internal Link Check](https://www.getpreflight.dev/security-checks/internal-links) - internal link checker: whether important pages are reachable through descriptive links from relevant hubs with a practical, evidence-led workflow for teams growing a documentation or content library.
- [Orphan Page Check](https://www.getpreflight.dev/security-checks/orphan-pages) - orphan page finder: whether a published page exists in the sitemap but has no useful path from the site hierarchy with a practical, evidence-led workflow for SEO operators managing large sites.
- [Redirect Chain Check](https://www.getpreflight.dev/security-checks/redirect-chains) - redirect chain checker: whether a visitor or crawler reaches the canonical page without unnecessary redirect hops with a practical, evidence-led workflow for teams migrating domains or routes.
- [Soft 404 Check](https://www.getpreflight.dev/security-checks/soft-404) - soft 404 checker: whether an unavailable or empty page returns a misleading success response with a practical, evidence-led workflow for content teams with retired or thin routes.
- [JavaScript Rendering Check](https://www.getpreflight.dev/security-checks/javascript-rendering) - JavaScript SEO checker: whether important copy and links exist in the rendered HTML available to crawlers with a practical, evidence-led workflow for teams shipping client-rendered applications.
- [Server-Rendered Content Check](https://www.getpreflight.dev/security-checks/server-rendered-content) - server rendered content checker: whether the page publishes its answer in the initial response instead of waiting for a fragile client request with a practical, evidence-led workflow for Next.js and React teams.
- [Image Alt Text Check](https://www.getpreflight.dev/security-checks/image-alt-text) - image alt text checker: whether meaningful images have concise alternative text and decorative images are marked appropriately with a practical, evidence-led workflow for content and frontend teams.
- [security.txt Check](https://www.getpreflight.dev/security-checks/security-txt) - security.txt checker: whether a researcher can find a clear, current route for reporting a vulnerability with a practical, evidence-led workflow for security-conscious site owners.
- [Privacy Signal Check](https://www.getpreflight.dev/security-checks/privacy-signals) - website privacy compliance checker: whether the public site makes its data collection, cookies, and contact choices understandable with a practical, evidence-led workflow for SaaS and marketing teams.
- [Access Control Check](https://www.getpreflight.dev/security-checks/access-control) - access control security checker: whether authorization decisions happen at the resource boundary rather than only in the interface with a practical, evidence-led workflow for teams protecting tenant and admin features.
- [Session Management Check](https://www.getpreflight.dev/security-checks/session-management) - session security checker: whether session creation, rotation, expiry, and revocation match the sensitivity of the product with a practical, evidence-led workflow for teams with account sessions.
- [Password Reset Check](https://www.getpreflight.dev/security-checks/password-reset) - password reset security checker: whether reset links expire, resist enumeration, and never grant more access than intended with a practical, evidence-led workflow for teams operating authentication flows.
- [Login Enumeration Check](https://www.getpreflight.dev/security-checks/login-enumeration) - login enumeration checker: whether login and recovery responses reveal which email addresses or usernames exist with a practical, evidence-led workflow for teams protecting account privacy.
- [API Error Disclosure Check](https://www.getpreflight.dev/security-checks/api-error-disclosure) - API error security checker: whether failures help a legitimate developer without exposing stack traces, secrets, or internal topology with a practical, evidence-led workflow for teams maintaining public JSON APIs.
- [Dependency License Check](https://www.getpreflight.dev/security-checks/dependency-license) - dependency license checker: whether package choices have a known license or policy conflict before a commercial release with a practical, evidence-led workflow for product teams shipping third-party code.
- [Backup Freshness Check](https://www.getpreflight.dev/security-checks/backup-freshness) - backup freshness checker: whether the recovery copy is recent enough for the business impact of a failure with a practical, evidence-led workflow for operators responsible for customer data.
- [Status Page Check](https://www.getpreflight.dev/security-checks/status-page) - status page checker: whether the status page is reachable, current, and scoped to the service customers actually use with a practical, evidence-led workflow for teams communicating incidents publicly.
- [Deployment Rollback Check](https://www.getpreflight.dev/security-checks/deployment-rollback) - deployment rollback readiness checker: whether the team can return to a known-good release without guessing during an incident with a practical, evidence-led workflow for teams shipping frequent releases.
- [Security Scanner for Vibe Coders](https://www.getpreflight.dev/use-cases/vibe-coder) - security scanner for vibe coders: how to turn a generated app into a release with evidence instead of trusting the code-generation step with a practical, evidence-led workflow for developers building with AI coding tools.
- [Security Checks for Indie Hackers](https://www.getpreflight.dev/use-cases/indie-hacker) - security scanner for indie hackers: which checks create the most risk reduction per hour before the first customers arrive with a practical, evidence-led workflow for solo founders shipping without a security team.
- [Pre-Launch Checks for SaaS Founders](https://www.getpreflight.dev/use-cases/saas-founder) - SaaS launch security checklist: whether signup, checkout, fulfillment, and recovery work as one customer path with a practical, evidence-led workflow for founders preparing a paid SaaS.
- [Security Workflow for Startup Teams](https://www.getpreflight.dev/use-cases/startup-team) - startup website security workflow: how to share a reliable release verdict without building a security operations department with a practical, evidence-led workflow for small product and engineering teams.
- [Website Scanner for Agencies](https://www.getpreflight.dev/use-cases/agency) - website security scanner for agencies: how to run consistent checks across client properties while keeping evidence and access scoped with a practical, evidence-led workflow for agencies responsible for multiple client sites.
- [Website Security Checks for Freelancers](https://www.getpreflight.dev/use-cases/freelancer) - website scanner for freelancers: how to prove a handoff is healthy and give a client a prioritized post-launch list with a practical, evidence-led workflow for freelancers delivering production websites.
- [Security Scanner for Next.js Teams](https://www.getpreflight.dev/use-cases/nextjs-team) - security scanner for Next.js teams: where browser, server, route, metadata, and deployment boundaries need separate verification with a practical, evidence-led workflow for teams building server-rendered React applications.
- [Security Scanner for Supabase Apps](https://www.getpreflight.dev/use-cases/supabase-team) - security scanner for Supabase apps: whether the public client, RLS policies, storage buckets, and server functions agree with a practical, evidence-led workflow for teams using Postgres and Supabase Auth.
- [Stripe Payment Path Monitoring](https://www.getpreflight.dev/use-cases/stripe-team) - Stripe payment path monitoring: how to detect a successful charge that never becomes customer access with a practical, evidence-led workflow for SaaS teams that provision access after payment.
- [Vercel Production Readiness Checks](https://www.getpreflight.dev/use-cases/vercel-team) - Vercel production readiness checker: how to catch domain, environment, deployment, and post-deploy regressions before users do with a practical, evidence-led workflow for teams deploying every day on Vercel.
- [Security Checks for Lovable Apps](https://www.getpreflight.dev/use-cases/lovable-builder) - Lovable app security scanner: which generated defaults to inspect before connecting a domain, database, or payment flow with a practical, evidence-led workflow for builders launching apps from Lovable.
- [Security Checks for Bolt Apps](https://www.getpreflight.dev/use-cases/bolt-builder) - Bolt app security scanner: how to move from a working demo to an observable, secure public release with a practical, evidence-led workflow for teams turning Bolt prototypes into products.
- [Security Checks for Cursor Projects](https://www.getpreflight.dev/use-cases/cursor-builder) - Cursor app security scanner: how to make security and release checks part of the same edit-run-ship cycle with a practical, evidence-led workflow for developers using Cursor across a fast iteration loop.
- [Security Checks for Claude-Built Apps](https://www.getpreflight.dev/use-cases/claude-builder) - Claude-built app security scanner: how to validate the deployed behavior instead of assuming generated code preserved the boundary with a practical, evidence-led workflow for teams using Claude to generate or refactor application code.
- [Security Scanner for No-Code Apps](https://www.getpreflight.dev/use-cases/no-code-builder) - no-code app security scanner: which public configuration and integration risks remain even when there is little custom code with a practical, evidence-led workflow for operators building with hosted no-code tools.
- [Pre-Launch Website Security Workflow](https://www.getpreflight.dev/use-cases/prelaunch) - pre-launch website security workflow: how to sequence checks so a short launch window produces useful evidence rather than a noisy backlog with a practical, evidence-led workflow for teams one week from launch.
- [Post-Deploy Website Verification](https://www.getpreflight.dev/use-cases/postdeploy) - post-deploy website verification: how to prove a deploy did not break the public surface or a business-critical path with a practical, evidence-led workflow for teams shipping frequent releases.
- [Security Review for a New SaaS](https://www.getpreflight.dev/use-cases/security-review) - security review for a new SaaS: which automated observations should become a manual security question before launch with a practical, evidence-led workflow for founders seeking a practical first review.
- [Security Evidence for Investor Due Diligence](https://www.getpreflight.dev/use-cases/investor-due-diligence) - SaaS security evidence for investors: how to present current, scoped reliability and security evidence without overstating what a scan proves with a practical, evidence-led workflow for founders preparing diligence materials.
- [Security Report for Client Handoffs](https://www.getpreflight.dev/use-cases/client-handoff) - website security report for clients: how to package actionable findings, ownership, and verification for a non-specialist stakeholder with a practical, evidence-led workflow for agencies and consultants handing over a live site.
- [Security Checks for Compliance Readiness](https://www.getpreflight.dev/use-cases/compliance-readiness) - SaaS security checks for compliance readiness: how to identify operational gaps and retain repeatable proof without calling a scanner a certification with a practical, evidence-led workflow for teams building an evidence trail before formal review.
- [Security Workflow for Remote Teams](https://www.getpreflight.dev/use-cases/remote-team) - security workflow for remote SaaS teams: how to make the next action and evidence clear across time zones with a practical, evidence-led workflow for distributed teams sharing production responsibility.
- [SEO and Security Checks for Growth Teams](https://www.getpreflight.dev/use-cases/growth-team) - SEO and security scanner for growth teams: how to remove technical barriers to search while keeping the public site trustworthy and fast with a practical, evidence-led workflow for growth teams responsible for organic discovery.
- [How to Scan Website Security](https://www.getpreflight.dev/guides/how-to-scan-website-security) - how to scan website security: how to move from a URL to a prioritized security checklist without confusing visibility with a full pentest with a practical, evidence-led workflow for site owners and developers.
- [How to Check if a Website Is Secure](https://www.getpreflight.dev/guides/how-to-check-if-a-website-is-secure) - how to check if a website is secure: which visible and operational signals give a useful first answer about trust and risk with a practical, evidence-led workflow for people evaluating a live website.
- [How to Fix a Noindex Tag](https://www.getpreflight.dev/guides/fix-noindex-tag) - how to fix noindex tag: how to find the directive, decide whether it is intentional, and verify the fix with a practical, evidence-led workflow for site owners whose pages are missing from Google.
- [How to Fix Sitemap Indexing Problems](https://www.getpreflight.dev/guides/fix-sitemap-indexing) - how to fix sitemap indexing: how to make the sitemap, canonical URLs, internal links, and page quality tell one consistent story with a practical, evidence-led workflow for content teams with discovered but unindexed URLs.
- [Website Security Checklist](https://www.getpreflight.dev/guides/website-security-checklist) - website security checklist: the practical checks worth running before a website carries real users, data, or money with a practical, evidence-led workflow for teams preparing a public release.
- [SaaS Launch Audit Guide](https://www.getpreflight.dev/guides/saas-launch-audit) - SaaS launch audit: how to audit the customer path from signup through payment, fulfillment, support, and recovery with a practical, evidence-led workflow for founders shipping their first paid product.
- [How to Test Stripe Webhooks](https://www.getpreflight.dev/guides/test-stripe-webhooks) - how to test Stripe webhooks: how to prove that a payment event is verified, processed, retried safely, and reflected in access with a practical, evidence-led workflow for developers implementing payment fulfillment.
- [How to Test Supabase RLS](https://www.getpreflight.dev/guides/test-supabase-rls) - how to test Supabase RLS: how to test the behavior users experience instead of trusting a policy file alone with a practical, evidence-led workflow for developers protecting tenant data.
- [How to Secure a Next.js App](https://www.getpreflight.dev/guides/secure-nextjs-app) - how to secure a Next.js app: how to connect framework configuration, browser headers, route protection, secrets, and deployment checks with a practical, evidence-led workflow for Next.js developers.
- [How to Secure AI-Generated Code](https://www.getpreflight.dev/guides/secure-ai-generated-code) - how to secure AI-generated code: how to review the deployed behavior that code generation can accidentally leave unsafe with a practical, evidence-led workflow for developers using code-generation tools.
- [How to Find Exposed API Keys](https://www.getpreflight.dev/guides/find-exposed-api-keys) - how to find exposed API keys: how to search public assets and decide whether a finding is a real secret that needs rotation with a practical, evidence-led workflow for frontend and security teams.
- [How to Configure a Content Security Policy](https://www.getpreflight.dev/guides/configure-content-security-policy) - how to configure CSP: how to introduce a useful policy without breaking the scripts and connections a product needs with a practical, evidence-led workflow for teams hardening web applications.
- [How to Configure CORS Safely](https://www.getpreflight.dev/guides/configure-cors-safely) - how to configure CORS: how to allow the frontend origins that need access without turning a credentialed API into a public one with a practical, evidence-led workflow for API developers.
- [How to Improve AI Visibility](https://www.getpreflight.dev/guides/improve-ai-visibility) - how to improve AI visibility: how to make important product facts crawlable, attributable, and easy to quote accurately with a practical, evidence-led workflow for brands that want answer engines to understand them.
- [How to Make a Site Citable by ChatGPT](https://www.getpreflight.dev/guides/make-site-citable-by-chatgpt) - how to make a website citable by ChatGPT: how to give retrieval systems a clear source page without relying on a magic file or keyword stuffing with a practical, evidence-led workflow for product and content teams.
- [How to Make a Website Indexable](https://www.getpreflight.dev/guides/make-website-indexable) - how to make a website indexable: how to remove technical blockers and create a coherent discovery path for search crawlers with a practical, evidence-led workflow for site owners launching a new domain.
- [Diagnose Discovered but Currently Not Indexed](https://www.getpreflight.dev/guides/diagnose-discovered-not-indexed) - discovered currently not indexed fix: how to separate crawl access from crawl priority and content quality with a practical, evidence-led workflow for SEO operators using Search Console.
- [How to Avoid Duplicate Content](https://www.getpreflight.dev/guides/avoid-duplicate-content) - how to avoid duplicate content: how to choose one useful URL and keep redirects, canonicals, links, and sitemaps aligned with a practical, evidence-led workflow for teams with variants, filters, and host aliases.
- [How to Create a Useful Comparison Page](https://www.getpreflight.dev/guides/create-comparison-page) - how to create a comparison page: how to compare tools honestly so the page helps a buyer instead of becoming a thin competitor doorway with a practical, evidence-led workflow for product marketing teams.
- [How to Build a Blog Topic Cluster](https://www.getpreflight.dev/guides/build-blog-topic-cluster) - how to build a blog topic cluster: how to connect one valuable hub with supporting articles that answer distinct questions with a practical, evidence-led workflow for SaaS content teams.
- [How to Write an SEO Article People Trust](https://www.getpreflight.dev/guides/write-seo-article) - how to write an SEO article: how to lead with the answer, show evidence, explain limits, and give the reader a next step with a practical, evidence-led workflow for founders and editorial teams.
- [How to Add Structured Data](https://www.getpreflight.dev/guides/add-structured-data) - how to add structured data: how to choose markup that matches visible content and validate it without overclaiming rich results with a practical, evidence-led workflow for developers adding schema to public pages.
- [How to Plan Internal Links](https://www.getpreflight.dev/guides/plan-internal-links) - how to plan internal links: how to help people and crawlers move from a broad answer to the exact next guide with a practical, evidence-led workflow for teams expanding a documentation or blog site.
- [How to Choose a Canonical URL](https://www.getpreflight.dev/guides/choose-canonical-url) - how to choose a canonical URL: how to identify the one address that should collect discovery and ranking signals with a practical, evidence-led workflow for developers managing host and route variants.
- [How to Write Robots.txt](https://www.getpreflight.dev/guides/write-robots-txt) - how to write robots.txt: how to keep private surfaces out of crawl paths while leaving important public content discoverable with a practical, evidence-led workflow for site owners controlling crawler access.
- [How to Run an SEO Audit](https://www.getpreflight.dev/guides/run-seo-audit) - how to run an SEO audit: how to turn a crawl into a ranked work queue instead of a spreadsheet of disconnected warnings with a practical, evidence-led workflow for SaaS and content teams.
- [How to Run an AEO Audit](https://www.getpreflight.dev/guides/run-aeo-audit) - how to run an AEO audit: how to test whether a page can be retrieved, understood, attributed, and cited with a practical, evidence-led workflow for teams optimizing for AI answers.
- [How to Build a Website Release Gate](https://www.getpreflight.dev/guides/build-release-gate) - website release gate checklist: how to make a deploy decision from current evidence instead of a last-minute manual smoke test with a practical, evidence-led workflow for teams shipping changes frequently.
- [What Is a Website Security Scanner?](https://www.getpreflight.dev/guides/what-is-a-website-security-scanner) - what is a website security scanner: what an automated scanner can observe from a URL and where a manual review begins with a practical, evidence-led workflow for people choosing a first security tool.
- [Website Scanner vs Vulnerability Scanner](https://www.getpreflight.dev/guides/website-scanner-vs-vulnerability-scanner) - website scanner vs vulnerability scanner: how broad website health checks differ from focused vulnerability discovery with a practical, evidence-led workflow for buyers comparing scanner terminology.
- [How to Audit an AI-Built App](https://www.getpreflight.dev/guides/audit-ai-built-app) - how to audit an AI-built app: how to inspect generated routes, data access, secrets, payments, and recovery behavior before launch with a practical, evidence-led workflow for developers shipping vibe-coded products.
- [Website Scanner Checklist](https://www.getpreflight.dev/guides/website-scanner-checklist) - website scanner checklist: which URLs, signals, and expected behaviors to include in a useful scan with a practical, evidence-led workflow for site owners preparing a repeatable scan.
- [Noindex vs Canonical: What Is the Difference?](https://www.getpreflight.dev/guides/noindex-vs-canonical) - noindex vs canonical: when to exclude a page and when to consolidate duplicate versions with a practical, evidence-led workflow for SEO operators debugging indexing.
- [Why a Sitemap URL Is Not Indexed](https://www.getpreflight.dev/guides/sitemap-not-indexed) - sitemap URL not indexed: why discovery through a sitemap does not guarantee crawl or indexing with a practical, evidence-led workflow for site owners using Search Console.
- [SEO vs AEO: How They Work Together](https://www.getpreflight.dev/guides/seo-vs-aeo) - SEO vs AEO: which fundamentals help both search engines and answer engines and which signals are distinct with a practical, evidence-led workflow for content and growth teams.
- [JSON-LD Structured Data for SaaS](https://www.getpreflight.dev/guides/json-ld-for-saas) - JSON-LD for SaaS website: which schema types make a product, organization, article, and FAQ easier to interpret with a practical, evidence-led workflow for SaaS marketing teams and developers.
- [Security Headers Guide for Websites](https://www.getpreflight.dev/guides/security-headers-guide) - website security headers guide: which headers to add first, what they protect, and how to avoid breaking required integrations with a practical, evidence-led workflow for developers hardening public sites.
- [Pre-Deploy Security Checklist](https://www.getpreflight.dev/guides/predeploy-security-checklist) - pre-deploy security checklist: what to verify in code, configuration, public assets, and the live host before promotion with a practical, evidence-led workflow for teams shipping a production release.
- [Public API Security Guide](https://www.getpreflight.dev/guides/public-api-security) - public API security guide: how to design and check authentication, authorization, rate limits, input handling, and error responses with a practical, evidence-led workflow for SaaS teams exposing APIs.
- [Website Health Check Guide](https://www.getpreflight.dev/guides/website-health-check-guide) - website health check guide: how to combine availability, performance, accessibility, security, and discoverability into one useful review with a practical, evidence-led workflow for operators evaluating a live site.
- [How to Fix Redirect Chains](https://www.getpreflight.dev/guides/fix-redirect-chain) - how to fix redirect chains: how to collapse extra hops and make the final canonical URL unambiguous with a practical, evidence-led workflow for teams moving routes or domains.
- [How to Fix Soft 404 Pages](https://www.getpreflight.dev/guides/fix-soft-404) - how to fix soft 404: how to return the right status and offer a useful replacement without misleading crawlers with a practical, evidence-led workflow for content teams retiring pages.
- [How to Improve Crawl Efficiency for a SaaS Site](https://www.getpreflight.dev/guides/optimize-crawl-budget-saas) - crawl budget for SaaS website: how to keep crawlers focused on useful public pages instead of duplicates or private surfaces with a practical, evidence-led workflow for teams with docs, blogs, and application routes.
- [Technical SEO for Next.js](https://www.getpreflight.dev/guides/seo-for-nextjs) - technical SEO for Next.js: how to configure metadata, static routes, rendering, canonical URLs, robots, sitemap, and structured data with a practical, evidence-led workflow for Next.js developers and marketers.
- [SEO for Supabase-Backed Websites](https://www.getpreflight.dev/guides/seo-for-supabase) - SEO for Supabase website: how to keep public rendering and private data boundaries separate while pages remain crawlable with a practical, evidence-led workflow for teams combining a public site with Supabase.
- [Choosing a Security Scanner for a Startup](https://www.getpreflight.dev/guides/security-scanner-for-startups) - security scanner for startups: how to compare coverage, setup, evidence, cost, and the work the team will really repeat with a practical, evidence-led workflow for startup founders buying an early tool.
- [How Agencies Can Standardize Website Scans](https://www.getpreflight.dev/guides/website-scanner-for-agencies) - website scanner for agencies guide: how to create a consistent audit and handoff without mixing client access or evidence with a practical, evidence-led workflow for agencies managing multiple client websites.
- [How to Keep Security Audit Evidence](https://www.getpreflight.dev/guides/security-audit-evidence) - security audit evidence checklist: which records make an automated finding reproducible and a remediation defensible with a practical, evidence-led workflow for teams preparing reviews or diligence.

## Technical and legal references

- Privacy: https://www.getpreflight.dev/privacy - how product data, credentials, and account information are handled.
- Terms: https://www.getpreflight.dev/terms - the terms governing use of the service.
- Robots: https://www.getpreflight.dev/robots.txt - crawler access policy for the public website.
- Sitemap: https://www.getpreflight.dev/sitemap.xml - canonical public URL inventory.
- Standard llms.txt endpoint: https://www.getpreflight.dev/llms.txt - this brief.
- Compatibility alias: https://www.getpreflight.dev/llm.txt - the same brief for clients that use the singular path.