Your builder nails the happy path, then swears it’s done. The other 20% — broken access control, unguarded admin APIs, 500s on bad input, secrets in the bundle — is where every AI build quietly fails. 80/20 Launch Audit is the senior developer that breaks into your app, proves what’s broken with evidence, and refuses to call anything done on a hunch. It runs inside your own Claude Code, Cursor, or Codex — your code never leaves your machine.
▶ The real dashboard — a live audit with evidence for every check.
Paste your live URL. We run the checks the free tools skip — Supabase / Firebase rules read with your own public key, API keys leaked in the bundle, admin routes open without auth, Stripe test keys in production, dev builds shipped by mistake — plus headers, cookies, CORS, HTTPS and SEO. Every finding comes with a paste-ready fix for Claude Code or Cursor. No signup, no code upload; only the URL leaves your browser.
They are not the same product at two prices. The free surface scan asks every question that can be answered from outside your app, from one HTTP conversation. The deep audit runs inside your agent, drives a real browser, logs in as two different people, and tries to cross the line between them. One is a look. The other is a break-in.
No install, no code, no login. Only the URL leaves your browser.
Chromium plus raw HTTP, driven from your own machine on your own agent subscription.
Not a mock-up. This is a real run against fixtures/buggy-shop — the open-source test target in our own repo, whose five planted bugs are written down in BUGS.md before the audit ever runs. Every number below came out of the engine. It found all five, and it says out loud which checks it could not run.
| Severity | Check | What broke, and why it costs you | Evidence |
|---|---|---|---|
| Critical | TC-ADM-004 · roles_permissions | Admin route blocks anonymous access: /admin/users/1A privileged surface answered an unauthenticated request. Server-side authorization is missing, not just UI-hidden. Expected a redirect, 401 or 403; got 200. | HTTP 200 |
| Critical | TC-MUT-002 · mutation_authz | Normal user denied privileged POST: /api/admin/delete-userSigned in as an ordinary user, the delete call succeeded. The button is gone from the UI; the action still fires for anyone who calls it directly. | HTTP 200 |
| Critical | TC-OBJ-001 · object_authz | No cross-user object access: /admin/users/1One id changed in the URL returned another person’s record, salary and SSN included. This is broken access control, tried and confirmed. | HTTP 200 |
| High | TC-API-003 · api_contract | Malformed input handled cleanly: POST /api/ordersA missing qty threw a TypeError and returned a raw stack trace in the response body. Your internals, handed to a stranger. |
HTTP 500 |
| High | TC-FE-009 · responsive_visual | No horizontal overflow on phone (390px)Horizontal overflow detected in a real 390px viewport, three attempts, three failures — not a one-off flake. Playwright trace attached. | 3 of 3 |
| High | TC-SEC-001 · security_headers | Hardening headers carry safe values: /No CSP, X-Frame-Options, X-Content-Type-Options or HSTS on any response. The cheap defenses that quietly never got turned on. | 0 of 4 |
| Verify | TC-TLS-001 · blocked | TLS/HSTS checks apply to an https deploymentNot run, and said so: the target is plain http, so HSTS and the http→https redirect are not meaningful here. A blocked check is a coverage gap, never a pass. | — |
The tool stays free and MIT: run the full deep audit in your own agent any time. If you would rather not, pick a tier below. Every tier runs the site-wide URL audit the moment you pay and delivers it three ways: on screen at a private link, as a PDF, and by email. Deep Audit and Pro add a person in a real browser. See a finished report first.
Secure checkout by Stripe, card or Link. We only ever touch the public URL you give us. If we cannot reach your site (bot wall, login wall, down), the order page says so and the run is refunded automatically. Prefer to keep it in-house? The same audit is free in your own agent: connect it above.
Every hosted scanner in this category needs your repository, or a login, or an agent installed on your infrastructure. The deep audit needs none of it, because it is not our software running on our servers — it is an MCP server running inside your Claude Code, Cursor or Codex, on your subscription, against a localhost URL if you like. We never see a file. There is no upload step to opt out of, because there is no upload.
The engine is MIT-licensed and the whole of it is on GitHub, so this is a claim you can read rather than one you have to believe. Check it.
80/20 Launch Audit runs as an MCP server inside the coding agent you already pay for. No API key to buy, no hosted backend, nothing to deploy. Copy one line, paste it into your agent, done.
1One command clones, installs, downloads Chromium, and registers 80/20 Launch Audit with Claude Code.
git clone https://github.com/Fusion-Data-Company/fusion-launchaudit.git && cd fusion-launchaudit && npm install && npx playwright install chromium && claude mcp add launchaudit -- node --experimental-strip-types ./runner/mcp-server.ts && npm run dashboard1Clone and install — identical to every agent.
git clone https://github.com/Fusion-Data-Company/fusion-launchaudit.git && cd fusion-launchaudit && npm install && npx playwright install chromium && npm run dashboard2Add a server named launchaudit to Cursor's MCP settings at ~/.cursor/mcp.json:
{ "mcpServers": { "launchaudit": { "command": "node", "args": ["--experimental-strip-types", "./runner/mcp-server.ts"] } } }1Clone and install — identical to every agent.
git clone https://github.com/Fusion-Data-Company/fusion-launchaudit.git && cd fusion-launchaudit && npm install && npx playwright install chromium && npm run dashboard2Codex CLI speaks MCP — register the same launchaudit server in your Codex config (same command, same args):
{ "mcpServers": { "launchaudit": { "command": "node", "args": ["--experimental-strip-types", "./runner/mcp-server.ts"] } } }Linters check syntax. 80/20 Launch Audit checks reality — the things AI builders confidently ship and quietly fake. It actively tries to break in, not just look around.
Change one id in the URL and read another user's data. We try it — and flag it when it works.
The button is gone from the UI, but the action still fires for anyone who calls it directly.
A sensitive endpoint with no server-side authorization check — wide open behind a friendly form.
Send a malformed request and the server returns a 500 with an internal stack trace.
No CSP, X-Frame-Options, or HSTS — the cheap defenses that quietly never got turned on.
API keys or a stray .env shipped straight into the client bundle, readable by anyone.
Horizontal scroll and clipped content at 390px — checked in a real viewport, not guessed.
The success toast appears; the data never persists. We reload and verify it actually stuck.
You already did — and it said it looked good. That’s the trap: your AI wants to help, so it tells you what you’re hoping to hear. It reads your own code and agrees with it. It won’t log in as a stranger to read your data, won’t hammer your API until it leaks, and never double-checks its own “looks fine.” 80/20 Launch Audit makes it do the opposite of people-pleasing.
A live browser plus raw HTTP. It logs in as two different users and tries to cross the line, sends the malformed input, and calls the admin endpoint it should never reach.
Every result carries evidence — a trace, a response, a screenshot. Not “looks fine.” Shown.
A separate watchdog re-runs every “pass.” Anything it can’t reproduce is flagged — never quietly counted as done.
Your AI is the eager junior who says ship it. 80/20 Launch Audit is the senior who says prove it — and does.
Real developers on why "your AI said it's done" isn't enough — and how 80/20 Launch Audit runs free, on your own machine and your own agent subscription.
Not hypotheticals — documented incidents and studies. This is why “your AI said it’s ready” isn’t enough.
The Register, 2025 · Replit / SaaStr incident
Veracode GenAI Code Security Report, 2025
Wiz, 2026 · Moltbook
Semafor · CVE-2025-48757 (Lovable)
Stanford, ACM CCS 2023
CodeRabbit, 2025 · 470 real GitHub PRs
From a running URL to a scored, evidence-backed punch list — and then the fixes — without leaving your editor.
One copy-paste registers 80/20 Launch Audit as an MCP server inside Claude Code, Cursor, or Codex — on your own subscription. Nothing to host.
Give it a running URL and optionally the repo. It scans the code, crawls the app, and runs real browser interactions plus direct HTTP probes.
A 0–100 readiness score, evidence for every check, and paste-ready fixes — then it applies them and re-verifies that they actually work.
A watchdog independently re-verifies every single “pass” against fresh evidence — re-running the interaction, re-fetching the response, re-reading the state. Anything it can't reproduce is flagged, never silently passed. So the score you get is the truth, not a hopeful guess.
It is not lying to you on purpose. It read your code, agreed with it, and never once logged in as a stranger to see what your app hands out. Somebody should do that before your first real user does.
Because one did. Connect 80/20 Launch Audit in under a minute and find out what's really between you and launch.
Send anything — a question about the platform, a test you want in the default suite, feedback, or a partnership. It goes straight to Fusion.