Preflyt

Preflyt is a pre-deployment security scanner for web apps, APIs, and backends. It checks deployments before they ship and focuses on exposed secrets, open ports, unsafe defaults, and other obvious deployment mistakes that can break real apps.

Its checks include exposed files such as .env and config files, .git repositories, backup and database dumps, source maps, and dependency files. It also looks at server and network exposure, including database ports for MySQL, Postgres, Redis, and MongoDB, as well as dev servers, admin panels, debug endpoints, Docker and Consul APIs, and HTTP hardening. The listed HTTP checks cover missing security headers such as CSP and HSTS, CORS misconfiguration, insecure cookie flags, and server version leakage. Preflyt says it is not a pentest tool or a vulnerability scanner; it is meant for the obvious deployment mistakes that matter in live applications.

The service can be run by scanning a URL with a single command: npx preflyt-check https://your-site.com. An optional --fail flag blocks deploys when issues are found. It is also designed to be used by AI agents, including Claude Code, Cursor, Copilot, OpenClaw, and Cline, and by any agent that supports AgentSkills. The product describes itself as read-only, and the scan runs after every deploy in the examples shown.

Preflyt is free and requires no signup. The page also states that more than 100 deployments have been scanned and that scans take about 20 to 30 seconds.