3 open-source checks before pushing AI-generated apps to production (Security, Browser QA & UI DNA)

When preparing to push AI-generated apps to production, it's crucial to run three essential open-source checks to ensure security, browser compatibility, and visual consistency. The first check, vibe-shield, is a static security scanner that scans your codebase for potential vulnerabilities in under a second. It checks for leaked Supabase service_role keys, unauthenticated Next.js API routes, IDOR bugs, prompt injection sinks, and SKILL.md poisoning.

With 92 rules, vibe-shield provides a comprehensive security analysis to protect your application from potential threats.

The second check, ghost-qa, is an autonomous headless Playwright browser QA tool. It tests your live app across eight different scenarios, including console errors, failed network calls, mobile layout collisions, 44px touch targets, WCAG accessibility, and dark/light mode parity. By simulating real user interactions, ghost-qa helps identify and fix browser compatibility issues before deploying your AI-generated app to production.

Lastly, unslop is a UI Design DNA linter and token exporter. It enforces a set of 72 design rules to ensure that your application adheres to a consistent visual style and follows best practices in UI design. unslop can identify and eliminate generic AI-generated design elements like purple gradients and poor typography. It enforces design archetypes and exports Tailwind v4/v3, CSS, and W3C tokens, guaranteeing a cohesive and professional look for your AI-generated app.

All three tools are free, MIT-licensed, and compatible with popular AI code editors such as Claude Code, Cursor, Windsurf, OpenCode, and VS Code. By utilizing these open-source checks, developers can confidently push their AI-generated applications to production, knowing that they have undergone thorough security testing, browser QA, and UI design validation.