Question 1

Does the Pre-Flight Audit Tool send my source code to a server?

Accepted Answer

No. All scanning happens in your browser tab. When you select files or a folder, contents are read locally with the File API and never uploaded. When you scan a public GitHub URL, the tool fetches raw blobs from raw.githubusercontent.com directly from your browser; the tool's origin never sees them. No analytics beacons, no remote storage.

Question 2

What does the Pre-Flight Audit Tool check?

Accepted Answer

26 probes covering hardcoded secrets (AWS, Stripe, OpenAI, Anthropic, GitHub, etc.), NEXT_PUBLIC_ leak of server secrets, Supabase Row-Level-Security misconfigurations, Firebase permissive rules, JWT algorithm: none, package.json supply-chain hooks, known-compromised package versions (Shai-Hulud / Axios / Mini Shai-Hulud), typosquatted and LLM-hallucinated package names, MCP server command-injection patterns, Cursor / Copilot rules-file backdoors, Trojan Source Unicode, prompt-injection sinks, system-prompt leakage to client bundles, missing security headers, CORS wildcards, SSRF and open-redirect patterns, and HTML hygiene (inline handlers, mixed content, CSP, target=_blank without rel=noopener).

Question 3

Is the Pre-Flight Audit Tool free?

Accepted Answer

Yes. No signup, no credit card, no usage limits. Free forever for the browser tool itself. Mid-Atlantic AI may offer paid services around it later, but the audit tool itself remains free.

Question 4

What kind of tool is this — and what is it NOT?

Accepted Answer

This is a free, in-browser static security audit. You drop in a folder or paste a GitHub URL; you get a report. It focuses on the failure modes specific to AI-generated code — prompt-injection sinks, MCP server misconfig, Cursor and Copilot rules-file backdoors, slopsquatted packages, system prompts leaked to client bundles — plus 2025-2026 supply-chain incidents by exact version. It is not a continuously-running enterprise AppSec platform with seat counts, dashboards, ticket integrations, and runtime protection. It is a free pre-merge gate you can run before you commit, with no signup and no data leaving your tab.

Question 5

Can the tool catch supply-chain attacks from 2025-2026?

Accepted Answer

Yes, by exact version. We hard-code known-compromised versions from Shai-Hulud (Sept 2025), Axios / Sapphire Sleet (March 2026), Mini Shai-Hulud (April 2026 SAP campaign and PyPI variant), Bitwarden CLI 2026.4.0, and more. Sources: CISA, GTIG/Mandiant, Socket, Wiz, Unit 42, OX Security.

Question 6

Does the tool work with apps not built by AI?

Accepted Answer

Yes — most probes are framework-agnostic and apply to any JavaScript / TypeScript / Python / Go / Ruby / HTML / SQL project. The branding emphasizes 'vibe-coded apps' because that is the cohort with the highest density of the specific vulnerabilities we catch (AI rules-file injection, slopsquatting, MCP misconfig, NEXT_PUBLIC_ leak in Lovable/Cursor exports). The tool itself is not limited to AI-generated code.