§01critical
Routing & Navigation
Dead ends, ghost routes, broken CTAs, blank Suspense pages.
- ›dead-end routes
- ›missing 404
- ›circular redirects
§02 · the verdict
One command. A senior engineer’s opinion.
Periderm is a pre-launch codebase scanner that catches user-losing bugs, legal liabilities, revenue leaks, runaway cloud bills and so many more before they hit production. Run it locally in your terminal. You get three scores, the top embarrassment risks, and the exact files to open.
~/your-app · periderm scanv0.1.0
$ periderm scan
↳ traversing 412 files…
↳ initializing ML defect predictor…
↳ extracting evidence for AI reviewer…
Periderm CLI Verdict
Launch Confidence: 64/100
Reality Score: 42/100
Perceived Performance: 58/100
Recommendation: DO NOT LAUNCH
Top embarrassment risks:
1. User profiles crash when avatars are missing (no ?. on user?.avatar?.url || '/default-avatar.png')
2. Three forms fail silently on API errors — no UI feedback
3. Footer references /terms — route does not exist
4. Broken images render with no fallback UI
5. Stripe webhook handler does not verify the signature
6. No production monitoring (Sentry) detected
▸ 14 findings · open in dashboard: periderm-cli.vercel.app/r/8f3a…
$_
§04 · supported stacks
Web, mobile, and monorepos — one scanner.
Periderm parses JS/TS/JSX with Babel, scans Dart and Swift sources, and handles monorepos smoothly.
React / Next.js.jsx · .tsx
AST checks, routes, error boundaries, SEO meta
Vue / Nuxt.vue · .js · .ts
framework detection, secrets, legal pages, SEO signals, JS/TS file checks
Svelte / SvelteKit.svelte · .ts
framework detection, secrets, legal pages, runtime checks on JS/TS
Angular.ts
full AST checks — security, error handling, unused imports, SEO meta
Astro.astro · .ts
framework detection, legal pages, SEO signals, JS/TS file checks
React Native / Expo.tsx · app.json
mobile patterns, OTA updates, native configs
Flutter.dart
HTTP/TLS, debug prints, pubspec signals
Swift / iOS.swift
ATS config, entitlements, Info.plist patterns
▸ also scans .mjs and .cjs — override context with .periderm/context.json when needed.
§05 · how it works
ESLint uses ASTs. Cursor uses AI. Periderm CLI uses both — in the right order.
layer L1ast · fs
Deterministic Engine
AST + filesystem analysis. The boring, reliable layer that finds missing alt text, dead links, hardcoded secrets, absent error boundaries, and 100+ other patterns.
layer L2ml · promise
ML Defect Predictor
A Random Forest classifier trained on the PROMISE ant-1.7 software defect dataset scores every source file on five code metrics. Files with a predicted defect probability above 50% are flagged before you ship.
layer L3ai · context-aware
AI Context Layer
Groq-powered project classification understands monorepos, admin dashboards, and mobile apps — filtering false positives before they hit your report. Scale/Unlimited get deep review for edge cases static rules miss.
▸ the moat isn’t a secret prompt — it’s knowing what to observe before AI starts thinking.
§03 · what it catches
150+ checks across 12 categories.
Each check is an AST rule or a filesystem probe. No guessing, no "let me just ask an LLM." Evidence first, then interpretation.
critical high medium
§02critical
Runtime Stability
Unhandled promises, missing error boundaries, leaked listeners.
- ›fetch without catch
- ›no error boundary
- ›memory leaks
§03critical
Auth & Authorization
Protected routes you forgot to protect. Logout you forgot to ship.
- ›unprotected admin
- ›no session check
- ›open password reset
§04critical
Legal & Compliance
You can be sued, fined, or taken down for compliance gaps you don't even know exist in your app.
- ›unseen compliance traps
- ›silent legal liabilities
- ›regulatory blind spots
§05high
Reality & Resilience
Empty arrays, missing avatars, offline users, double-clicks.
- ›items[0] with no guard
- ›no img onError
- ›no offline UI
§06high
Loading & Transitions
Pages that feel frozen, infinite spinners, layout shift.
- ›no skeleton
- ›stuck Suspense
- ›CLS on data load
§07high
Observability
You can’t fix what you can’t see. Sentry, logs, analytics.
- ›no Sentry init
- ›console.log in prod
- ›no uptime ping
§08high
Data Integrity
Silent corruption: missing validation, races, double submits.
- ›client-only validation
- ›no idempotency
- ›no delete confirm
§09critical
Security
Headers, secrets, dangerous HTML, CSRF, open redirects.
- ›hardcoded keys
- ›missing CSP
- ›no webhook signature check
§10medium
SEO & Discoverability
Sitemaps, OG tags, duplicate titles, placeholder content left behind.
- ›missing og:image
- ›no sitemap
- ›placeholder text
§11high
Accessibility
Real humans use keyboards, screen readers, and contrast.
- ›no alt text
- ›div onClick
- ›keyboard traps
§12critical
Runaway Cloud Costs
The financial DDoS. An infinite loop in a serverless function quietly bills you for a weekend.
- ›unbounded recursion
- ›no rate limit
- ›log spam
§01 · philosophy
Every feature is a potential liability.
“Launch” isn’t the day you go live. It’s every feature you build. Periderm CLI turns the question “will this make me lose users, revenue or get into legal trouble?” into a check you run on autopilot.
Named after the outer protective layer of a plant — the part that keeps the inside safe from the environment. Scans of plant periderms measure resilience, track healing from wounds, and study how effectively the plant blocks water loss and pathogen entry. That’s what we want this to be: a thin, reliable shell between your code and the chaos of production.
▸scan · frontend codebase
⚠ Detected severe compliance exposure in user onboarding. High risk of regulatory fines.
▸scan · database schema
⚠ Identified fatal data integrity vulnerabilities. Malicious actors could silently corrupt records.
▸scan · api endpoints
⚠ Discovered critical infrastructure exhaustion traps. Infinite loops could drain platform quotas overnight.
▸scan · cloud storage
⚠ Found catastrophic information disclosure risks. Sensitive assets are exposed to public indexing.
§06 · the loop
Change → scan → fix → repeat.
Wire Periderm CLI into your CLI, your CI, or your editor save hook. Every change gets reviewed like a senior engineer just glanced over your shoulder.
$ periderm watch$ periderm scan$ periderm review --deep⌘ periderm-bot commented on PR #482 · 12s ago
Launch Confidence
62/100 -9
Reality
48/100 -14
Perceived Performance
71/100 +3
- criticalsrc/components/ProfileCard.tsx · L42
user.avatar.url accessed without a fallback. Users without a photo will see a broken image.
- highsrc/routes/dashboard.tsx · loader
Fetching data without a loading state. Users may perceive the page as frozen on slow networks.
- criticalsrc/lib/jobs/sync.ts · L78
Recursive call has no termination condition behind a feature flag — potential runaway invocation cost.
§08 · pricing
Cheaper than one embarrassing launch.
Starter
$0/forever
For makers who want a sanity check before shipping.
- ✓Run the CLI locally, unlimited
- ✓15 cloud scans / month
- ✓Local report dashboard
- ✓All 150+ deterministic checks
- ✓Live scan progress + check counters
- ✓Privacy policy vs codebase cross-check
Scale
popular$29/1000 scans
For people shipping fast with AI, on real users.
- ✓Everything in Starter
- ✓AI reviewer (senior-engineer mode)
- ✓CLI deep review agent (`periderm review --deep`)
- ✓Automated CLI reporting
- ✓Scan history + diff between scans
Unlimited
$99/month
For teams where every release is a launch.
- ✓Unlimited cloud scans
- ✓Deep review agent + dashboard AI reviewer
- ✓Org-wide scan dashboard
- ✓Custom rules + ignore policies
- ✓SSO + audit log
- ✓Priority support
§07 · faq
Questions before you scan.
Stop shipping ideal-conditions software.
Your next feature is a launch. Make sure it doesn’t lose you the users you don’t know about yet.
requires Node.js 18+ · periderm command