Preflight · Launch audit suite for AI-built products
Audit your AI-built product before your users do.
Five adversarial audit protocols you run yourself. Paste one into your coding agent, point it at your live product, get a scored verdict and a gap list.
01 · Why this exists
AI builds fast. Preflight makes sure it ships safe.
Roughly 45% of AI-generated code carries an OWASP Top 10 vulnerability. (Veracode, 2025)
170 apps built on one AI builder leaked user data through a security policy that existed but did not restrict anything. (CVE-2025-48757)
The controls that fail most often look correctly configured. Reading the code passes them. Probing the live product does not.
Preflight probes your live product with the wrong credentials, the wrong role, and the wrong network, then reports what actually happens.
02 · Proof
Tested on our own products first.
Before launch, we ran every protocol on three live products we built. This is what it found.
A cross-tenant data leak
Any free signup could read another customer's full asset library by changing one HTTP header.
Proven live: 94 rows returned from another tenant.
Fixed before a single external customer was onboarded.
A live credit-minting exploit
An anonymous caller could grant themselves 100,000 credits and delete other users' accounts.
The revoke in the code looked correct and did nothing.
Fixed and confirmed dead by live probe.
No recovery path
A production database with no backups, no point-in-time recovery, and hard deletes on every row.
Escalated to a launch blocker.
Fixed before launch.
Every finding above was made by the protocols in this package, on products we built.
03 · What’s inside
Five protocols. 592 checks. Every layer scored.
Each protocol is a complete audit prompt. Paste it, give it inputs, let it run.
Security hardening
9 layers · 159 checks · 6 launch blockers
Tenant isolation, secrets in the client, authorization at the data layer, payment webhooks, supply chain, AI endpoints and agents, infrastructure, privacy.
Weakest-link scored: the grade is the lowest layer, never the average.
Resilience and operations
6 layers · 105 checks · 5 launch blockers
Load and capacity, backups and disaster recovery, spend caps and denial-of-wallet, observability and incident response, data lifecycle and migration safety, content safety.
Journey
4 layers plus sub-domains · 113 checks · 5 hard gates
Core Web Vitals, WCAG 2.2, onboarding, conversion path, discoverability, trust surfaces.
Mobile-first, scored on throttled 4G and a mid-tier phone.
Signature
5 layers · 115 checks
Robustness under stress, motion, typography, states and edge cases, interface copy.
The craft signal AI generation leaves out, with a dated fingerprint module.
Hallmark
5 layers · 100 checks
Brand distinctiveness and coherence across every surface.
Measured against evidence, not feeling.
04 · The operator kit
Plus everything you need to run them.
Operator guide. The access you need, the run order, how to read a verdict.
Four checklists, 61 items. Pre-run inputs, the master launch-blocker list, silent-failure controls, re-cert triggers, and a fifteen-minute monthly check.
Report template. Fill it as you go, so evidence never gets lost to a summary.
Field notes. 16 findings from real audits, including the four-layer SECURITY DEFINER fix, the shared-tenant question, and the uncapped-provider check.
12 months of refreshes as CVEs, standards, and framework versions move.
05 · How it works
How it works
Open your coding agent with your repo.
Claude Code, Cowork, Cursor agent, Codex, or any agent that can read your repo and reach your live URL.
Paste one protocol as the first message.
Give it the inputs it asks for: your live URL, two test accounts, database access.
Read the verdict.
It probes your live product and hands you a scored verdict, a launch-blocker table, and a gap list with fixes and effort.
Claude CodeCoworkCursorCodex06 · Who it’s for
Built for people shipping AI-built products.
A good fit
You built, or are building, a product with AI coding tools.
You can run a coding agent against your own repo.
You have access to your database and hosting consoles.
You would rather find it yourself than read about it later.
Not a fit
You only have a chat window and no repo access. The protocols need to run probes.
You want someone to run the audit for you. That is a service, and we offer it separately.
07 · What a pass means
What a passing grade means, and what it does not.
Passing is an evidenced floor, not a guarantee.
The protocols prove the controls that exist and the results of the probes they ran.
They cannot prove the absence of a vulnerability.
They do not replace penetration testing, threat modeling, or legal counsel. They make those cheaper and shorter.
08 · Built by Deeper Designs
Built by Deeper Designs.
Deeper Designs is a build studio working from Delhi and Dubai. We build custom software and AI systems for Indian businesses, shaped to how each one already works.
We run four live products of our own: Outpost, Oviya Studio, Deeper Content and Maple Lens. Preflight was run against our own products before it was sold to anyone.
Preflight exists because we needed it. It found a cross-tenant leak and a credit-minting exploit in our own products before launch. Now it is the protocol we ship with.
Everything we build is owned by the client. One price, agreed in writing before we start. No per-seat licence.
09 · Get Preflight
One price. Everything included.
10 · Questions
Questions
A coding agent that can read your repo and reach your live deployment, two test accounts at the same privilege level, and access to your database and hosting consoles.
No. The protocols run live probes against your product. A chat window with no repo or network access cannot do that.
No. It means the documented failure modes were tested and did not reproduce on audit day. It is an evidenced floor, not a guarantee.
Each protocol lists its cadence and triggers. At minimum: continuous automated scanning, a quarterly pass, a full re-audit yearly or on any listed trigger such as a new framework version or a new AI feature.
The protocols name specific CVEs, standards, and framework versions. When those move, the protocols are updated. You receive updated files for twelve months.
There is no refund. Preflight is a digital download and you receive the full package once payment is confirmed. Read what is inside and who it is for before you buy.
No. Preflight is a digital download, delivered in full on payment, so there are no refunds.