{"slug": "3-open-source-checks-before-pushing-ai-generated-apps-to-production-security-qa", "title": "3 open-source checks before pushing AI-generated apps to production (Security, Browser QA & UI DNA)", "summary": "Developer Aviv Gerz released three MIT-licensed open-source tools for vetting AI-generated apps before production: vibe-shield, a 92-rule static security scanner and MCP guard that flags leaked Supabase service_role keys, unauthenticated Next.js API routes, IDOR bugs and prompt-injection sinks in about a second; ghost-qa, a headless Playwright browser QA agent that checks live apps across eight failure categories including console errors, failed network calls, mobile layout collisions and WCAG accessibility; and unslop, a 72-rule UI design linter and token exporter that enforces ten design archetypes and exports Tailwind, CSS and W3C tokens. All three are listed on the Official MCP Registry and work with Claude Code, Cursor, Windsurf, OpenCode and VS Code.", "body_md": "Stop pushing AI-generated apps to production without running these 3 open-source checks first:\n\n🛡️ vibe-shield — 92-rule static security scanner & MCP guard (catches leaked Supabase service_role keys in client code, unauthenticated Next.js API routes, IDOR bugs, prompt injection sinks & SKILL.md poisoning in ~1s):\n\n[https://github.com/avivgerz-hue/vibe-shield](https://github.com/avivgerz-hue/vibe-shield)\n\n👻 ghost-qa — Autonomous headless Playwright browser QA (tests your live app across 8 traps: console errors, failed network calls, mobile layout collisions, <44px touch targets, WCAG accessibility & dark/light mode parity):\n\n[https://github.com/avivgerz-hue/ghost-qa](https://github.com/avivgerz-hue/ghost-qa)\n\n🎨 unslop — 72-rule UI Design DNA linter & token exporter (strips generic AI purple gradients & bad typography, enforces 10 studio design archetypes, and exports Tailwind v4/v3, CSS & W3C tokens):\n\n[https://github.com/avivgerz-hue/unslop](https://github.com/avivgerz-hue/unslop)\n\nAll 3 are 100% free, MIT-licensed, live on the Official MCP Registry (`io.github.avivgerz-hue/*`), and work with Claude Code, Cursor, Windsurf, OpenCode & VS Code.\n\n⭐ Star the repos on GitHub to save them for your next build!", "url": "https://wpnews.pro/news/3-open-source-checks-before-pushing-ai-generated-apps-to-production-security-qa", "canonical_source": "https://dev.to/avivgerzhue/3-open-source-checks-before-pushing-ai-generated-apps-to-production-security-browser-qa-ui-dna-3igo", "published_at": "2026-11-11 14:09:56+00:00", "updated_at": "2026-11-11 14:53:16.125982+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-agents", "agent-protocols", "ai-safety"], "entities": ["vibe-shield", "ghost-qa", "unslop", "Aviv Gerz", "Official MCP Registry", "Claude Code", "Cursor", "GitHub"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/3-open-source-checks-before-pushing-ai-generated-apps-to-production-security-qa", "markdown": "https://wpnews.pro/news/3-open-source-checks-before-pushing-ai-generated-apps-to-production-security-qa.md", "text": "https://wpnews.pro/news/3-open-source-checks-before-pushing-ai-generated-apps-to-production-security-qa.txt", "jsonld": "https://wpnews.pro/news/3-open-source-checks-before-pushing-ai-generated-apps-to-production-security-qa.jsonld"}}