Deploy audit for vibe-coded apps.

After you say it can read the repo, it looks for the leaks that actually ship: keys in the client bundle, service-role in the browser, .env in git, RLS off, unauthenticated POSTs. Then it writes a verdict.

Any Critical: DO NOT SHIP. It won’t probe a URL you didn’t give it, and it won’t mark a leaked key FIXED until you confirm you rotated it in the dashboard. It doesn’t push a deploy.

Free skill: npx skills add stdevMac/security-research