# Preflyt

## What is Preflyt?
Preflyt is a deterministic pre-deployment security scanner that analyzes live web and backend deployments for publicly accessible secrets, misconfigurations, and unsafe defaults in under 30 seconds.

## What Preflyt is NOT
- Preflyt is not a penetration testing tool
- Preflyt is not a vulnerability scanner (like Snyk or Nessus)
- Preflyt is not a CI/CD pipeline tool (yet)
- Preflyt is not a code analysis or SAST tool

## Who is Preflyt for?
- Indie developers shipping fast
- Vibe coders using AI to build apps
- Developers deploying web or backend applications
- Solo founders deploying their first production app
- Small teams without dedicated security engineers

## What does Preflyt check?

### File & Code Exposure
- Exposed .env and config files containing database passwords, API keys, and secrets
- Exposed .git repositories allowing source code reconstruction
- Exposed package.json / composer.json revealing dependency versions
- Exposed backup and database dump files
- Exposed JavaScript source maps revealing original source code
- Exposed PHP configuration (phpinfo) pages
- Exposed Firebase configuration
- Directory listings
- Sensitive file exposure

### Server & Network Security
- Open database ports (MySQL 3306, PostgreSQL 5432, MongoDB 27017, Redis 6379, Elasticsearch 9200, CouchDB 5984)
- Exposed development servers (Node 3000, Vite 5173, Angular 4200, Jupyter 8888)
- Exposed admin tools (Docker API, Prometheus, Consul)
- Unprotected admin panels
- Leaking API endpoints returning data without authentication
- Debug and diagnostic routes left enabled in production

### HTTP Hardening
- Missing HSTS (Strict-Transport-Security) header
- Missing X-Frame-Options header
- Missing X-Content-Type-Options header
- Missing Content-Security-Policy header
- Missing Referrer-Policy header
- Missing Permissions-Policy header
- CORS wildcard misconfiguration (Access-Control-Allow-Origin: *)
- Insecure cookie flags (missing Secure, HttpOnly, SameSite)
- Server version leakage in response headers

## Command Checker
Preflyt also includes a terminal command checker that scans commands before you run them, detecting:
- Typosquatted packages (e.g., npm instaII express vs npm install express)
- Hidden Unicode characters
- Piped downloads (curl | bash patterns)
- Known malicious package names

## CLI Tool (npx)
Preflyt is available as an npm package. Run `npx preflyt-check <url>` to scan any deployed URL from the terminal. No install required.
- Use --fail to exit with code 1 when issues are found (blocks CI/CD deploys)
- Use --share to generate a shareable report link (valid for 30 days)
- Use --key to authenticate with a Pro license for unlimited scans
- Works with GitHub Actions, deploy scripts, git hooks, and any CI/CD pipeline
- For frontend deploys (Vercel, Netlify), use a GitHub Action. For backend deploys (VPS, bare metal), add to your deploy script or git hook.
- Integration guide: https://preflyt.dev/integrate

## How it works
1. User pastes a URL
2. Preflyt runs deterministic checks against the live server from an external perspective
3. Results show in ~30 seconds with severity ratings and fix instructions
4. No signup required. 3 free scans.

## Pricing
- Free: 3 scans, includes all checks
- Pro: $9.99/month, unlimited scans

## Links
- Website: https://preflyt.dev
- Command Checker: https://preflyt.dev/terminal
- About: https://preflyt.dev/about
- Twitter: https://x.com/preflytdev

## Technical Details
- CDN-aware: Detects Vercel, Netlify, Cloudflare, CloudFront, GitHub Pages to avoid false positives
- SPA-aware: Detects React, Next.js, Vue, Angular, Nuxt to avoid false positives from client-side routing