The last step used to belong to someone else. You designed the thing, a developer built it, and before anyone sent the link they spent five minutes looking for the problems you cannot see from the canvas.
A key left in the page. A database anyone can read. A form that zooms the whole screen open on an iPhone. Three old copies of the header still sitting in the project.
When you build with an agent, that review often never happens. The person who prompted the work is the person who has to check it, and they were not trained to look for those things. The site looks right. It works on their laptop. They send the link.
A verdict in plain English
I built Designer Preflight for that moment. It checks the project and the running site, then gives one answer: ready to share, ready to share with care, or not ready yet.
The report is sorted by what to do first. Each problem says what is wrong, why it matters to the person using the site, and roughly how long a fix takes. It does not assume you already know what row level security means.
- Security. Leaked keys, tables anyone can read or change, packages with known problems, and package names that do not exist.
- Phones. Pages that scroll sideways, fields that make Safari zoom in, content cut off by the screen height, buttons hidden behind the home bar.
- Access. Missing image descriptions, low contrast, unlabelled buttons and fields, zoom that has been switched off.
- Leftovers. Old copies, placeholder text, duplicate libraries, colours that are almost the brand colour but not quite.
- Sharing. Heavy images, missing titles and descriptions, no share image, no real 404 page.
Nothing changes until you say so
The useful part is what it refuses to do. It does not rewrite the project and call that finished. You approve each fix, or you say a finding is fine as it is. Approved fixes go on a separate branch, one commit each, so any of them can be thrown away.
It photographs every screen at phone, tablet and desktop size. After a fix it shows what changed, so you can see that nothing else broke. Keys are never printed in full, and they are never sent anywhere.
It is also honest about what it cannot see. Pages behind a login, and the feel of a real phone, stay outside the check. The report says so, and hands you a ten-minute pass to do on your own device.
On the map, if you have one
If FlowMap is installed, the same findings appear on the journey board. Problems sit on the screens they belong to, and you can approve a fix from there. Preflight uses FlowMap’s list of screens, so it checks the ones a crawler would miss, not only the pages it can reach by following links.
Designer Preflight is free and open source. It runs as a skill in Cursor, Claude Code and Codex: open the project and ask it to run a preflight.
The project is on GitHub: github.com/noellyonsgit/designer-preflight.
