cryptozachla

App Doctor — Security skill for Claude Code

Security community

Audit any web app's security (39-point checklist) AND launch-readiness (legal, auth, polish, retention), report exactly what's missing with the fix for each gap, then implement the fixes.

How to install App Doctor

This entry records only its repository, not the path inside it, so there is no exact command to give. Open cryptozachla/app-doctor and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What App Doctor does

Audit any web app's security (39-point checklist) AND launch-readiness (legal, auth, polish, retention), report exactly what's missing with the fix for each gap, then implement the fixes. A portable Claude Code / agent skill — deepest on Supabase + Vercel + Stripe.

Alternatives in Security

Defense In Depth — Implement multi-layered testing and security best practices 98.1k ★
Token Scan — Meme coin and token security scan — checks for rug pull vectors (hidden mint, honeypot, fee manipulation, LP l 3.8k ★
Perplexity Super Skills — Complete collection of 12 Perplexity Computer Super-Skills merging Perplexity + Claude Code capabilities acros 346 ★

README

🛡️ App Doctor — Security Doctor + Pre-App Checklist

Formerly **security-doctor** — the security half is unchanged; a launch-readiness half is new. Old links redirect.

**A Claude Code / agent skill that audits any web app's security AND launch-readiness, tells you exactly what's missing with the fix for each gap, and implements the fixes.**

Most "security checklists" are lists of things to worry about. Security Doctor is different: every one of its 39 checks (33 manual + a 6-tool automated scanner layer) tells the agent **how to detect the gap in your actual codebase** (a grep pattern or a live probe against your running app), **which fix closes it** (one of 12 copy-paste SQL/JS templates), and **how to verify the fix actually landed** — so you get a scored report backed by evidence, not vibes.

It's deepest on the **Supabase + Vercel + Stripe** stack (where a browser-shipped anon key makes every database permission a public one), but the underlying laws are stack-portable.

![What App Doctor does](app-doctor-map.png)

Why it exists

If your frontend talks to Supabase with a publishable/anon key, that key is in your page source — which means **every permission the `anon` role holds, the entire internet holds.** A lock icon in your UI is a suggestion; the real gate is at the database and the API. Most apps ship with holes here that never show up in normal use: anon-writable tables, `SECURITY DEFINER` functions callable by strangers, admin gates keyed on a client-editable field, a CSP that looks fine until a feature quietly dies.

Security Doctor was distilled from real production audits into a single reusable skill so you don't have to re-learn each of these the hard way.

What it checks (39 points, 9 domains)

Domain	Examples
Transport & headers	HSTS, secure cookies, `nosniff`/frame/referrer, CSP enforcing (no `unsafe-inline`)
Auth flows	password-reset actually offers a set-password screen, login lockout (fail-**op