---

name: release-check description: Comprehensive release readiness audit covering security, dependencies, community files, and code quality. Use when asked for a "release check", "release readiness" review, or "pre-release verification".

Release Readiness Audit

Pre-release cross-cutting check: security, dependencies, required community files, and code quality. Documentation and metadata checks live in /release-docs-check — run that separately.

---

1. Dependency vulnerabilities

npm audit --audit-level=high

• Confirm zero High / Critical
• If any remain, distinguish direct vs. transitive in the report
• Note whether npm audit fix can resolve them

---

2. Required community files

Use Glob to confirm each file exists:

| File | Purpose | |------|---------| | LICENSE | License (required) | | README.md | Project overview (required) | | CONTRIBUTING.md | Contribution guide (required) | | SECURITY.md | Vulnerability reporting policy (required) | | CODE_OF_CONDUCT.md | Code of conduct (recommended) | | .env.example | Environment variable template (required) |

---

3. Personal / project-specific info leaks

Grep (excluding node_modules, .next, .git):

• Personal domains / URLs: scan source for \.info, \.dev, \.me patterns
• Personal names / handles: repository owner names must not be hardcoded in source
• Project-specific names: your own project or brand names (e.g., my-blog-name) must not remain in source

Allowed locations: package.json, README.md, CONTRIBUTING.md, SECURITY.md, LICENSE, _release/.

---

4. Secrets / credential leaks

Grep for these patterns:

• API key prefixes: sk-, AIza, ghp_, xoxb-, AKIA
• Hardcoded passwords: password\s*=\s*["'][^"']{8,}
• Bearer tokens: Bearer [A-Za-z0-9+/]{20,}

Read .env.example and verify it contains placeholders only.

---

5. Code quality

• Stray console.log: Grep under app/(admin)/baan-admin/api/
• TODO/FIXME/HACK: Grep under app/, lib/ (minor ones are warnings)
• Japanese error messages: confirm API responses under app/(admin)/baan-admin/api/ do not contain Japanese (exclude translation files like _lib/i18n.ts)

---

6. Baseline security configuration

• .gitignore: .env*, data/, *.pem, .session-secret, etc. are excluded
• package.json: "private": true is set correctly (appropriate for an application)
• TypeScript strict: tsconfig.json has strict: true

---

7. GitHub repository settings (manual)

Cannot be verified from code — confirm manually before release:

• [ ] GitHub Private Vulnerability Reporting enabled (Security tab)
• [ ] Default branch is main
• [ ] Branch protection rules set up (if required)

---

Output format

Clean: ✅ OK Issue: ❌ description (file:line) Warning: ⚠️ description Manual check: 👤 description

Summary format

## Release Readiness

| Category | Status |
|----------|--------|
| Dependency vulnerabilities | ✅ / ❌ |
| Required community files | ✅ / ❌ |
| Personal info leaks | ✅ / ❌ |
| Secret leaks | ✅ / ❌ |
| Code quality | ✅ / ⚠️ / ❌ |
| Baseline security | ✅ / ❌ |

### Verdict
🟢 READY / 🟡 CAUTION / 🔴 NOT READY