npm package: @railly/last30
Description: Production readiness scanner for vibecoded projects
Author: Railly Hugo
Latest version: 0.1.0

# last30

Production readiness scanner for vibecoded projects. Lighthouse for apps built with Lovable, Bolt, v0 and other AI tools.

AI does 70%. You own the last 30%.

## Install

```bash
npx last30 audit
```

Or install globally:

```bash
bun add -g last30
```

## Usage

```bash
# Scan current directory
last30 audit

# Scan specific path
last30 audit ./my-lovable-app

# JSON output (for CI/CD)
last30 audit --json

# Only show critical issues
last30 audit --level critical
```

## Output

```
last30 v0.1.0

Scanning: ./my-lovable-app
Detected: Lovable (vite_react_shadcn_ts)

Production Readiness Score: 23/100

CRITICAL (4)
  SEC-001  Hardcoded API key in src/integrations/supabase/client.ts:4
  SEC-002  Supabase anon key exposed in client bundle
  ERR-001  No error boundaries detected (0 ErrorBoundary components)
  TST-001  No test files found (0 .test.ts, 0 .spec.ts)

WARNING (4)
  SEO-001  SPA-only: no SSR capability (Vite + React Router)
  COD-001  TypeScript strict mode disabled in tsconfig.json
  DEP-001  No CI/CD configuration (.github/workflows/)
  ERR-002  12 empty catch blocks found

INFO (3)
  COD-002  45 shadcn/ui components installed, 23 unused
  DEP-002  No monitoring setup (Sentry, LogRocket, etc.)
  SEO-002  No sitemap.xml or robots.txt

Run `last30 audit --json` for machine-readable output.
Learn more: https://thelast30.dev
```

## Checks

| Category | Weight | What It Checks |
|---|---|---|
| Security | 25% | Hardcoded keys, exposed secrets, missing .env, anon keys in source |
| Auth | 15% | Auth pattern quality, session handling, protected routes |
| Error Handling | 10% | Error boundaries, try/catch coverage, empty catch blocks |
| Testing | 10% | Test files, CI config, coverage setup |
| SSR/SEO | 10% | SPA detection, meta tags, sitemap, robots.txt |
| Code Quality | 10% | TypeScript strictness, linter config, unused code |
| Database | 10% | Client-side queries, missing migrations, raw SQL exposure |
| Deployment | 5% | CI/CD config, env separation, monitoring |
| Accessibility | 5% | Alt tags, aria labels, semantic HTML |

## Scoring

- **0-25**: Not production ready, critical issues.
- **26-50**: Needs work, security and reliability gaps.
- **51-75**: Getting there, missing professional practices.
- **76-100**: Production ready, ship it.

## Detected Frameworks

| Framework | Detection |
|---|---|
| Lovable | `vite_react_shadcn_ts` in package.json, `lovable-tagger` dep |
| Bolt.new | `.bolt/` directory, Bolt markers |
| v0 | v0 markers in project |
| Generic Vite+React | `vite` + `react` in deps |
| Next.js | `next` in deps (used as baseline) |

## CI/CD Integration

```yaml
# .github/workflows/audit.yml
name: Production Readiness
on: [push]
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx last30 audit --json > audit.json
      - run: npx last30 audit --ci --min-score 50
```

`--ci` exits with code 1 if score is below `--min-score`.

## Comparison

| Feature | last30 | NextLovable | vibe-audit |
|---|---|---|---|
| Production score | 0-100 | No | No |
| Security checks | 8 rules | No | No |
| Auth analysis | Yes | Migration only | No |
| Testing checks | Yes | No | No |
| SEO/SSR detection | Yes | No | No |
| Lovable detection | Yes | Yes | No |
| Bolt detection | Yes | No | No |
| Free | Yes | $39-$450 | Yes |
| Zero deps | Yes | No | Yes |
| CI/CD mode | Yes | No | No |
| Offline | Yes | No | Yes |

## Part of The Last 30%

This CLI is the free audit tool from [The Last 30%](https://thelast30.dev), a course series teaching vibecoders the software engineering fundamentals AI can't fake.

`npx last30 audit` tells you what's wrong. The course teaches you why and how to fix it.

## License

MIT