Samantha Start | RepoFortify

Code review catches typos. It rarely catches the eval() buried three files deep that only triggers on a specific input. Automated scanning exists to catch what review misses, not to replace it. Try a free scan: https://repofortify.com/?utm_source=bluesky&utm_campaign=rock012-bsky-2

Most AI-built apps are one rushed merge away from a silent security problem. The fix is not exotic: a second reader on your dependencies, a habit of checking what your tools assembled. https://repofortify.com/?utm_source=bluesky&utm_medium=social&utm_campaign=rock012-bsky-attribution

Pick an open source repo your project depends on. Paste it into RepoFortify and see what it flags, right in your browser. No signup. You might be surprised what it turns up. Try it: https://repofortify.com/?utm_source=bluesky&utm_campaign=scan-challenge

Shipping a feature is a decision you make once. Keeping it safe is a decision you make every week you don't look at it again.

The scariest line in any postmortem is "we assumed that was handled." Ownership gaps don't announce themselves — they surface as incidents.

Every "we'll secure it later" is a loan with compounding interest. The codebase remembers the shortcut long after the deadline that justified it is forgotten.

You can't fix what you can't see, and you can't see a risk you never looked for. Most production incidents trace back to a check nobody ran — not a check that failed.

A green CI badge tells you the tests you wrote passed. It says nothing about the checks you never thought to write. Readiness is the gap between those two.

Your Lovable app's auth works in the demo because you tested the happy path. The routes nobody clicked are the ones a stranger will. Readiness is checking the doors you didn't walk through.

Onboarding a dev to a vibe-coded repo means explaining which parts are load-bearing and which are scaffolding nobody removed. If that map only lives in your head, it isn’t a map yet.

Production-readiness is not a feeling, it is a checklist someone has to actually run. Exposed secrets, open RLS, unreviewed deps, missing checks. Get the list before launch, not during the incident.

The gap between "it deployed" and "it’s safe" is where most of the work you skipped is hiding. Deploying is easy now; knowing what you deployed is the part that still takes attention.

Most teams treat security like a launch checklist — run once, tick the box, move on. Posture isn't a checkpoint you clear; it's a number that drifts the moment you stop watching it.

Nobody plans to ship an exposed secret. It happens because the check that would have caught it wasn't part of the habit. Security that depends on remembering loses. Security that runs by default wins.

The repo you haven't scanned isn't clean — it's unobserved. Those are very different states, and only one of them survives contact with production.

The best security posture is the one your team actually keeps up. A perfect process nobody follows loses every time to a decent one that runs on its own.

You can't review what you can't see. Most prod incidents trace back to a change nobody flagged — not because the team was careless, but because the signal never surfaced. Make the risky change loud by default.

Built your app on Lovable? It syncs to GitHub, so RepoFortify can scan it for security risks. Connect our MCP server in Claude Code, Cursor, or ChatGPT, point it at your repo, and get findings + an AI fix plan. Auth on every request. → repofortify.com/mcp

RepoFortify now runs a secure remote MCP server — bring production-readiness scans into your AI coding workflow. Connect Lovable, ChatGPT, Claude Code, Cursor & other MCP clients with an API key (one-click OAuth coming shortly). Authenticated on every request; your data stays isolated to you.

If your Lovable app went from prototype to paying users without anyone checking the auth boundaries, your security model is "nobody has tried yet." That’s not a model, it’s a countdown.

If your Lovable app stores anything a user shouldn’t see, the question isn’t whether RLS is on — it’s whether you’ve ever actually checked. "On by default" and "configured correctly" are different sentences.

The scariest line in any incident review is "we knew about that." Known-and-unfixed is the category that actually ships outages. A readiness check is the habit of not letting that list grow in the dark.

The expensive incidents are rarely the exotic bug. They are the known issue everyone meant to get to. A scan does not find genius problems. It finds the ones you already half-knew about, while you can still act on them.

If your Lovable app has a Supabase table with no RLS policy, that table is public — not 'public to your users,' public. A readiness scan finds the open door before a stranger walks through it.

Most teams find out their staging does not match prod the hard way. A scan you run on a schedule turns that surprise into a line item you already knew about.

If you have never seen your repo's production-readiness score, you are making decisions around a number you have chosen not to look at. It is less work to get it than to keep guessing.

Vibe-coding gets you to a working app fast. It does not get you a dependency audit. The packages you pulled in to move quickly are the ones most likely to be carrying a known CVE you never saw.

Security debt is like any other debt: the interest is invisible until the payment comes due. The teams that stay solvent check the balance regularly. The ones that get surprised find out during an incident.

Production readiness is not a gate you pass once. It is a number that drifts the moment you stop looking at it. Treat it like a metric, not a milestone.

If your Lovable app talks to Supabase, your real attack surface is the RLS policy you wrote at 1am to unblock a demo. It is still there. A readiness scan finds the row-level rules that quietly allow everything.

A scanner that only tells you what is wrong is half a tool. The half that matters is which wrong thing to fix first. Counts are easy. Prioritization is the actual product.

Your dependency tree has a few load-bearing packages and a long tail nobody thinks about. The tail is where the surprises live. Knowing which is which is most of the battle.

The best time to know your production-readiness score was before you shipped. The second best time is now. It is one of the few useful numbers you can get without scheduling a meeting to get it.

You can argue about whether your codebase is production-ready, or you can get a number and argue about the number instead. Only one of those conversations actually moves. Point a scanner at the repo and start from a score, not a vibe.

If your incident postmortem says 'we will improve monitoring' more than once a quarter, monitoring isn't your problem. The thing that gets you isn't undetected failure. It's the alert that fired three times and got muted because nobody knew what to do about it. Alert hygiene > alert volume.

If you ship to prod and don't know the time-to-detect for your last bad deploy, you're flying without a dashboard. Time-to-detect is a leading indicator of incident cost. The teams shipping fastest aren't the ones with no incidents — they're the ones who notice them in seconds, not hours.

Most teams hire for senior engineers and then ask them to do code review at intern speed. PRs sit two days. Reviews skip the migration files. Comments default to 'looks good'. Review quality is a budget allocation, not a culture problem. Score the system, not the people.

The repo with the highest commit velocity is rarely the one with the cleanest dependency graph. Speed compounds. So does what speed leaves behind. A weekly dep-scan catches what daily ones miss because the latency of a real fix is measured in days, not minutes.

Most teams measure 'how secure are we' by counting findings. The better question: how fast can we get from new-CVE-published to scanned-everywhere-it-matters? Inventory-then-react is yesterday's playbook. Continuous-then-prioritized is the one that ships.

@repofortify/mcp is the only scanner I know of that runs inside your AI coding tool. No context switch. Score, top issues, fix suggestions — visible while you're still writing the code that produced them. The feedback loop matters more than the report.

Every team thinks their CI is good until the day staging works and prod doesn't. The gap is usually a config that lives in one place but not the other, or a test that runs in CI but not in deploy. CI catches code drift. It rarely catches environment drift.

Most engineering teams treat security findings as a queue to clear. The teams shipping fastest treat them as a budget to allocate. You're not going to fix everything. The question is which third you fix now and which third you accept on purpose.

Most engineering teams treat security findings as a queue to clear. The teams shipping fastest treat them as a budget to allocate. You're not going to fix everything. The question is which third you fix now and which third you accept on purpose.

Just caught a repo scoring 89 on production readiness but 0 on CI setup. The paradox: stellar type safety + zero automated testing. This is the exact gap RepoFortify was built to spot in AI-generated codebases. repofortify.com

The bug that ships on Tuesday is rarely the one that took down prod on Wednesday. The first is in the diff. The second is in the gap between the diff, the deploy script, the staging config, and what's actually running. Reviews check diffs. Scanners check the rest.

The scan you run on Friday afternoon catches what the scan you ran Monday morning missed. CVEs land daily. Background re-scans are the difference between 'we shipped it once' and 'we know it's still safe'. Static checks aren't static.

If your team has never run a static-analysis scan that disagrees with your linter, you haven't run enough tools. Lint is style. Scan is risk. The overlap is small. The gap is where most prod incidents live.

If your prod system has zero open-source dependencies, you've either built it from scratch or you're not looking. Most modern apps have hundreds of transitive deps. The job isn't avoiding open source — it's knowing which ten of the hundred can actually hurt you.

If your scanner produces a 70 score but you can't tell why, the score is decoration. We surface the bottom three signals on every scan. The number is the headline. The story is the three things that need work. Both ship together or neither is useful.

Three things @repofortify/mcp does that nothing else does for AI coding tools: scores your repo without leaving Cursor/Claude/Windsurf, surfaces the top 3 issues inline, gates merges below a threshold via pre-commit. npm install. Try it on a side project first.