/security
Catch leaked keys and risky routes before you deploy
Pre-deploy safety sweep across secrets, env hygiene, dependency advisories, and risky API routes.
What it does
AI agents paste API keys into code, leave debug endpoints open, and never once mention that a package you depend on has a known vulnerability. /security is the sweep you run before deploying: hardcoded secrets, environment-file hygiene, dependency advisories, and API routes with risky patterns like missing auth checks or wildcard CORS (any site can call your API).
The mechanical checks run as real code in the Boost OS command-line tool, not as instructions the AI might skim. That means a leaked key is found by a pattern scanner, not by hoping the model was paying attention. Findings come back ranked: fix-before-deploy versus worth-knowing.
What it looks like
/security
Two fix-before-deploy findings. A Stripe live key is hardcoded in app/api/checkout/route.ts line 14. Move it to your environment settings and rotate it, since it's in git history. And /api/admin/users has no auth check; anyone with the URL can list your users. Worth knowing: one dependency has a moderate advisory, patched in the next minor version. Everything else is clean.
Illustrative exchange. Output adapts to your actual project.
When to type /security
- You're about to deploy and want one last safety pass
- You suspect a key got pasted into code somewhere along the way
- You want to know if any dependency has a known vulnerability
- An agent wrote your API routes and nobody security-minded has read them
Pairs well with
Works in every major agent
/security installs as a plain file in your project and runs wherever your agent does.
Get /security and 21 more commands
Install it once. One license gets your agent the full Boost OS menu, seven always-on guards, and a memory of your project that survives between sessions. Lifetime updates.
From $99 · 7-day refund · license key emailed instantly