Checks source you already generated against the secureFlows integration rules. Needs no secureFlows token; safe at
scaffolding time. Pass every auth/session-related file in one call — some checks are evaluated across the whole set.
Two kinds of findings:
• scope "file" — a forbidden construct is present (localStorage token, legacy /app/login, fetch-based logout,
client-side JWT decode, empty catch, restore non-auth errors clearing session UI, Continue CTA gated on null session, ...), reported at an exact file:line.
• scope "project" — REQUIRED handling is missing everywhere you passed in: detecting 401/410 but never clearing the
token, never handling 403, or handling 403 without the BILLING_GRACE_LOCK carve-out. These are the defects that
actually dominate real generated apps, and no "forbidden pattern" check can see them, because the bug is an absence.
Heuristic text analysis, not a parser or a type checker. It can miss things it has no rule for, and a project check can
be satisfied by the right keyword in the wrong place. It is a fast first pass — not a substitute for the Agent
implementation checklist in SKILL.md, and specifically not for the checks that need a running app (auth-guard mount
races, the fresh-reload check). Fix every "error" before calling an integration done; treat "needs_review" as a lead.
ConnectorNo auth