Not deployed yet? Grade it on localhost first.

1. The repo-only checks

From the repository root:

npx securealy local

No URL, no account. It reads the folder and your own keys on your own machine, and nothing leaves it. What it checks: secrets in git history, whether .gitignore covers the whole .env* family, whether .env.example names every variable the code reads, row level security on every table the public key can reach, Stripe webhook wiring to the right domain and events, and Vercel env hygiene (a secret set for the wrong environment, or a server key with a public prefix). Each failure names the check and the fix.

2. The pre-launch grade

Start the dev server, then grade it:

npx securealy grade http://localhost:3000

This is the same grade as the one on the home page, run from your machine against your running app: headers, secrets in the bundle, the database key and what it can list, the 404 status, legal pages, analytics, SEO. TLS, DNS, mail and registration checks skip, because there is no domain to read, and a skip is not a pass. Fix what fails now; it is cheaper here than after launch.

3. Get to a domain

The Fix Kit's Module 00 (Foundations) and Module 01 (Ship it) take you from a folder to a live URL: the repository, the host project, the domain and its records, the database, staging and production. Or open AUTOPILOT.md and paste its one prompt: your AI creates the repo, the host project, the domain records and the database with the tokens you give it, and writes the few things only you can do to a to-do list.

Once the domain answers, run the same command against it, or paste it on the home page. That grade is the real one, and the monitor keeps it current on every deploy.