launch-playbooklisted

# launch-playbook — Pre-Launch Security Playbook Run a **time-boxed, evidence-based** security playbook before public launch. **Agent-agnostic procedure.** Same steps on Claude Code, Gemini CLI, OpenAI Codex/ChatGPT agents, Cursor, Windsurf, Grok, or a human with a terminal. Loading differs by host (see README); execution does not. | | | |--|--| | **Goal** | Baseline that stops the failures fast-shipped apps actually hit | | **Not a goal** | Enterprise audit, pentest cert, HIPAA/PCI/SOC2 | | **Budget** | ~30 minutes of agent work; depth over theater | | **Rule** | No finding without path/evidence. No “might be vulnerable” without a reason. | Load when needed (paths relative to this skill folder): - `references/checklist.md` — human checklist - `references/scan-playbook.md` — commands + secret patterns - `references/ai-prompts.md` — optional deep-dive prompts If invoked without skill auto-load: user may attach or `@` this file. Follow it fully anyway. --- ## Modes | User intent | Mode | |-------------|------| | Default / “audit” / “checklist” | **Report only** | | “Fix it” / “make it shippable” | **Remediate** then re-score | | “Quick” / “10 min” | **Fast path**: secrets → access control → paid APIs → auth → stop | Do not rotate production secrets, wipe data, or force-enable RLS that locks out prod without explicit confirmation. --- ## Phase 0 — Detect stack (2 min, mandatory) Inspect lockfiles, config, and imports. Record in the report: ```text Framework: Next.js