Notre avis

Effectue un audit complet avant la mise en production, couvrant les vulnérabilités des dépendances, les fichiers communautaires, les fuites d'informations personnelles, les secrets, la qualité du code et la configuration de sécurité de base.

Points forts

Vérifie plusieurs dimensions (sécurité, qualité du code, configuration) en une seule exécution.
Distingue les problèmes de dépendances directs et transitifs.
Fournit une sortie claire avec des symboles ✅/❌/⚠️.
Inclut des vérifications automatisées et des rappels manuels pour les paramètres GitHub.

Limites

Dépend de npm audit, qui peut avoir des faux positifs ou manquer des vulnérabilités.
Certaines vérifications (fuites d'informations personnelles) peuvent nécessiter une connaissance du domaine pour éviter les faux positifs.
Ne peut pas vérifier automatiquement les paramètres du dépôt GitHub ; nécessite une confirmation manuelle.

Quand l'utiliser

Utilisez avant toute mise en production pour vous assurer que tous les pièges courants sont traités.

Quand l'éviter

Ne convient pas pour des vérifications rapides sur des projets non critiques ou lorsque seulement un sous-ensemble de vérifications est nécessaire.

name: release-check description: Comprehensive release readiness audit covering security, dependencies, community files, and code quality. Use when asked for a "release check", "release readiness" review, or "pre-release verification".

Release Readiness Audit

Pre-release cross-cutting check: security, dependencies, required community files, and code quality. Documentation and metadata checks live in /release-docs-check — run that separately.

1. Dependency vulnerabilities

npm audit --audit-level=high

Confirm zero High / Critical
If any remain, distinguish direct vs. transitive in the report
Note whether npm audit fix can resolve them

2. Required community files

Use Glob to confirm each file exists:

| File | Purpose | |------|---------| | LICENSE | License (required) | | README.md | Project overview (required) | | CONTRIBUTING.md | Contribution guide (required) | | SECURITY.md | Vulnerability reporting policy (required) | | CODE_OF_CONDUCT.md | Code of conduct (recommended) | | .env.example | Environment variable template (required) |

3. Personal / project-specific info leaks

Grep (excluding node_modules, .next, .git):

Personal domains / URLs: scan source for \.info, \.dev, \.me patterns
Personal names / handles: repository owner names must not be hardcoded in source
Project-specific names: your own project or brand names (e.g., my-blog-name) must not remain in source

Allowed locations: package.json, README.md, CONTRIBUTING.md, SECURITY.md, LICENSE, _release/.

4. Secrets / credential leaks

Grep for these patterns:

API key prefixes: sk-, AIza, ghp_, xoxb-, AKIA
Hardcoded passwords: password\s*=\s*["'][^"']{8,}
Bearer tokens: Bearer [A-Za-z0-9+/]{20,}

Read .env.example and verify it contains placeholders only.

5. Code quality

Stray console.log: Grep under app/(admin)/baan-admin/api/
TODO/FIXME/HACK: Grep under app/, lib/ (minor ones are warnings)
Japanese error messages: confirm API responses under app/(admin)/baan-admin/api/ do not contain Japanese (exclude translation files like _lib/i18n.ts)

6. Baseline security configuration

.gitignore: .env*, data/, *.pem, .session-secret, etc. are excluded
package.json: "private": true is set correctly (appropriate for an application)
TypeScript strict: tsconfig.json has strict: true

7. GitHub repository settings (manual)

Cannot be verified from code — confirm manually before release:

[ ] GitHub Private Vulnerability Reporting enabled (Security tab)
[ ] Default branch is main
[ ] Branch protection rules set up (if required)

Output format

Clean: ✅ OK Issue: ❌ description (file:line) Warning: ⚠️ description Manual check: 👤 description

Summary format

## Release Readiness

| Category | Status |
|----------|--------|
| Dependency vulnerabilities | ✅ / ❌ |
| Required community files | ✅ / ❌ |
| Personal info leaks | ✅ / ❌ |
| Secret leaks | ✅ / ❌ |
| Code quality | ✅ / ⚠️ / ❌ |
| Baseline security | ✅ / ❌ |

### Verdict
🟢 READY / 🟡 CAUTION / 🔴 NOT READY

Audit de préparation à la version

Recommandé pour