Launch checks
These guides are the launch gaps that are not themselves an exploit. An old lockfile is a list of bugs you have not read. A product that collects accounts or payments needs a privacy page and terms that name what you actually do. Cloudflare's security-audit skill can drive an agent through a source audit, and the skill file tells that agent to stop when the invocation budget cannot cover a full run.
Guides
Outdated dependencies
A lockfile full of old packages is a pile of known bugs you have not looked at. Some are security fixes and some are noise, so you still have to look.
Missing privacy policy and terms
If you collect accounts, emails, or payments, you need a page that says what you collect and a page that says the rules of the product.
Run Cloudflare's security-audit skill
Cloudflare's security-audit skill is a free MIT skill that drives a coding agent through a source audit. A full run spends agent invocations, and the skill file tells the agent to stop when the budget cannot cover them.
Questions
Should I upgrade every dependency the audit flags?
No. Read the advisory. Some are security fixes and some are noise. Commit the lockfile, review the diff, and do not treat a green check as a review of a major bump.
Is a privacy policy the same thing as this site's privacy page?
No. ShipSecurely's privacy page describes this site. If your app collects accounts, email, or payments, you need your own page that names the processors you use and a contact address that reaches you.
Does the security-audit skill confirm every finding?
No. The skill distinguishes a confirmed issue from one that still needs validation. Set an agent-invocation budget before a full audit, and do not treat needs_validation as a confirmed bug.