Add Vibe Launch Safety sales pack

Author: bmtriet

README.md

@@ -28,6 +28,7 @@ Build a practical evolution loop for Codex:
 
 Revenue work starts in `docs/revenue-strategy.md` and `experiments/opportunities/`.
 The first offer is documented in `docs/offer-vibe-agent-repo-safety-audit.md`.
+The public sales pack starts at `docs/sales/vibe-launch-safety-sprint.md`.
 Quota fallback is documented in `docs/llm-gateway-fallback.md`.
 Use `python3 scripts/llm_coworker.py` as the LLMGate coding co-worker command.
 Mission Control starts at `ops/README.md`.

docs/autonomous-outreach-policy.md

@@ -9,6 +9,7 @@ FreeCodex is allowed to run autonomous outreach for the Vibe/Agent Repo Safety A
 - Send at most 3 outbound messages per automation run.
 - Offer the first 3 consenting public repo audits for free while validating the workflow.
 - Mention the paid offer only as a later option, without pressure.
+- Do not include PayPal or payment links in first-contact outreach.
 - Log every sent message under `leads/sent/`.
 
 ## Not Allowed
@@ -42,4 +43,3 @@ For each sent message, create a public-safe log file in `leads/sent/` with:
 - Follow-up status.
 
 Do not log private contact information or sensitive findings.
-

docs/offer-vibe-agent-repo-safety-audit.md

@@ -13,15 +13,15 @@ Fast AI-built apps can launch before their safety basics catch up. This offer is
 
 ## Pricing
 
-- First 3 consenting public repo audits: free while the workflow is being validated.
-- Report-only audit: USD 49.
+- Standard report-only audit: USD 49.
 - Report plus bounded small fixes: starts at USD 199 after the report is delivered and scope is confirmed.
+- A few free validation slots may be available for strong public-fit repos while the workflow is being validated.
 
-Payment link: https://www.paypal.com/paypalme/softreveal
+First-contact outreach does not include payment links. Payment details are shared only after a positive reply, scope confirmation, and consent to proceed.
 
 ## Turnaround
 
-Most lightweight reports are delivered within 24-48 hours after repo permission and payment, if payment applies.
+Typical lightweight report turnaround is 24-48 hours after repo permission and payment, if payment applies, subject to current queue.
 
 ## Scope
 
@@ -51,6 +51,16 @@ Send:
 
 Do not send secrets, passwords, tokens, cookies, or private keys.
 
+## Sales Pack
+
+- `docs/sales/vibe-launch-safety-sprint.md` - packaged offer.
+- `docs/sales/vibe-launch-safety-scope.md` - scope, boundaries, and done criteria.
+- `docs/sales/vibe-launch-safety-intake.md` - public-safe intake questions.
+- `docs/sales/vibe-launch-safety-outreach.md` - first-contact templates with no payment links.
+- `docs/sales/vibe-launch-safety-followup.md` - positive-reply and paid-path follow-ups.
+- `docs/sales/proof-of-work-prs.md` - proof-of-work PR guidelines.
+- `templates/vibe-launch-safety-report.md` - delivery report template.
+
 ## Disclaimer
 
 This is a lightweight launch/readiness audit. It is not a certified penetration test, legal advice, compliance guarantee, or proof that a repository is secure.

docs/sales/proof-of-work-prs.md

@@ -0,0 +1,54 @@
+# Proof-Of-Work PRs
+
+Proof-of-work PRs are small, public contributions that demonstrate FreeCodex can spot and fix launch-readiness issues without making a generic sales pitch.
+
+## When To Open One
+
+Open a PR only when:
+
+- The repo is public.
+- The fix is obvious, narrow, and low-risk.
+- The project accepts public contributions.
+- The change does not require credentials, private context, or production access.
+- The PR can stand alone even if no sale happens.
+
+Good PR examples:
+
+- Add or improve `SECURITY.md`.
+- Add `.env` and local secrets to `.gitignore`.
+- Clarify that service-role keys must stay server-side.
+- Add a conservative CSP or CORS note when the existing app already has relevant config.
+- Add webhook signature verification documentation.
+- Add launch-readiness notes to README.
+- Add a missing env example without real values.
+
+Avoid:
+
+- Deep unpaid remediation.
+- Large refactors.
+- Security theater.
+- Anything that exposes suspected secrets publicly.
+- Changes that need private testing or account access.
+- Repeated PRs to the same repo without invitation.
+
+## How To Reference The PR
+
+Lead with the useful contribution, then mention the audit only as optional.
+
+```text
+I opened a small PR for one launch-readiness item I noticed here: [PR URL].
+
+If useful, I also do lightweight public-repo safety reviews for AI-built apps and agent workflows. No credentials or account access needed, and it is not a certified pentest.
+```
+
+Do not include payment links in the first contact.
+
+## How Much Value To Give Away
+
+The PR should fix one clear issue or add one helpful guardrail. It should not become a full unpaid audit or broad fix sprint.
+
+If the repo has many findings, deliver the small PR and offer the mini audit scope after the maintainer shows interest.
+
+## Tracking
+
+Log sent messages and PR URLs under `leads/sent/`. Mission Control summarizes outcomes in `ops/outcomes.md`.

docs/sales/vibe-launch-safety-followup.md

@@ -0,0 +1,53 @@
+# Vibe Launch Safety Follow-Up
+
+Use this only after a positive reply, an explicit request for scope, or consent to continue.
+
+## Positive Reply
+
+```text
+Thanks - happy to take a look.
+
+Quick scope note: this is a lightweight public-repo launch/readiness audit, not a certified pentest or security guarantee. I will not need credentials, cookies, private keys, account access, or production access.
+
+To confirm fit, please send:
+
+1. Public repo URL
+2. Launch context and timing
+3. Main stack/hosting
+4. Any auth, payment, webhook, Supabase/Firebase, MCP, or agent workflow areas to pay attention to
+5. Whether you want the USD 49 report-only mini audit, or just want to be considered for a limited validation slot if available
+```
+
+## Paid Mini Audit Confirmation
+
+Use only after the prospect has replied positively, scope has been confirmed for one public repo, and they have consented to proceed with the paid report-only path.
+
+```text
+Great. The report-only mini audit is USD 49 for one public repo.
+
+Deliverable: a concise markdown report with prioritized launch/readiness findings, redacted evidence, and recommended next actions. This is not a certified pentest or security guarantee, and no credentials or account access are needed.
+
+Payment can be sent here: https://www.paypal.com/paypalme/softreveal
+
+After payment, I will review the repo and aim to deliver within 24-48 hours, subject to current queue.
+```
+
+## Fix Sprint Follow-Up
+
+Use only after the report has been delivered.
+
+```text
+Based on the report, I see a bounded fix sprint that could help: [short scope].
+
+The fix sprint starts at USD 199 and would include [one PR / one patch set / specific small fixes]. It would stay within the public repo and will not require credentials or account access.
+
+If that scope looks useful, I can confirm the exact deliverable and timeline before starting.
+```
+
+## No-Fit Reply
+
+```text
+Thanks for the context. I do not think this is a good fit for the lightweight public-repo audit because [reason].
+
+I would rather not overstate what this service can safely cover. A certified security review or specialist help may be a better path here.
+```

docs/sales/vibe-launch-safety-intake.md

@@ -0,0 +1,34 @@
+# Vibe Launch Safety Intake
+
+Use this intake after a prospect gives a positive reply or explicitly asks for the audit.
+
+Do not ask for secrets, passwords, tokens, cookies, private keys, private logs, account access, or production access.
+
+## Questions
+
+1. Public repo URL:
+2. What are you launching, and when?
+3. Is the app built with AI coding tools or agents? If yes, which ones?
+4. Main stack and hosting platform:
+5. Does the app use auth, payments, webhooks, Supabase, Firebase, MCP servers, external APIs, or agent tools?
+6. What are you most worried about before launch?
+7. Do you want the USD 49 report-only mini audit, or are you also open to a bounded fix sprint after the report?
+8. Are there areas you want excluded from review?
+9. Are you okay with a public-safe PR if small fixes are possible?
+10. Can FreeCodex reference the repo as anonymized proof-of-work, with no sensitive details?
+
+## Internal Triage
+
+Accept when:
+
+- The repo is public or explicit permission is documented.
+- The request fits lightweight launch/readiness review.
+- No credentials or private account access are required.
+- The work can be delivered with local tooling and manual review.
+
+Decline or defer when:
+
+- The request needs a certified pentest or compliance attestation.
+- The repo handles sensitive personal-data contexts where a lightweight public review is not enough.
+- The user sends secrets or asks for secret handling.
+- The expected fix work is broad, urgent production incident response, or outside current capability.

docs/sales/vibe-launch-safety-outreach.md

@@ -0,0 +1,46 @@
+# Vibe Launch Safety Outreach
+
+This playbook is for first-contact messages only.
+
+## Rules
+
+- First contact never includes PayPal or payment links.
+- Keep the message short and specific to the public context.
+- Mention that the review is lightweight and not a certified pentest.
+- Say no credentials or account access are needed.
+- Include an easy opt-out.
+- Do not follow up unless the recipient replies or explicitly invites it.
+
+## GitHub Issue Or Discussion
+
+```text
+Hi - saw this public repo/thread and thought the launch-readiness angle might be relevant.
+
+I do lightweight public-repo safety reviews for AI-built apps and agent workflows: obvious leaked-secret indicators, env examples, GitHub Actions/agent review prompts, CSP/CORS hints, webhook/auth review prompts, and missing launch basics.
+
+Not a certified pentest, and no credentials or account access needed. If useful, I can share what a small repo audit would cover. No worries if not useful.
+```
+
+## After A Small Proof-Of-Work PR
+
+```text
+Hi - I opened a small public PR for one launch-readiness item I noticed here: [PR URL].
+
+I also do lightweight public-repo safety reviews for AI-built apps and agent workflows. The review looks for obvious leaked-secret indicators, env/example issues, CI/agent review prompts, CSP/CORS hints, and webhook/auth review prompts.
+
+Not a certified pentest, and no credentials or account access needed. Happy to share the scope if useful. No worries if not.
+```
+
+## Short DM Or Email
+
+Use this only when the person has publicly invited relevant contact.
+
+```text
+Hi - I saw your public launch/repo and noticed it may fit a lightweight launch-readiness review.
+
+I review public repos for AI-built apps and agent workflows: obvious secret patterns, env/example safety, GitHub Actions/agent review prompts, CSP/CORS hints, and webhook/auth review prompts. Not a certified pentest, and no credentials or account access needed.
+
+If helpful, I can send the small audit scope. No worries if not useful.
+```
+
+For autonomous use, follow the 3-message-per-run limit and log messages under `leads/sent/`.

docs/sales/vibe-launch-safety-scope.md

@@ -0,0 +1,71 @@
+# Vibe Launch Safety Scope
+
+This scope keeps the offer simple enough to deliver quickly and honest enough to sell safely.
+
+The standard offer is for public GitHub repos. Private repos are not part of the standard public-safe pack and require explicit permission plus separate scope confirmation.
+
+## USD 49 Mini Audit
+
+Included:
+
+- One public GitHub repository.
+- Local deterministic checks plus manual review.
+- One markdown report.
+- Findings labeled by priority and launch impact.
+- Redacted evidence only.
+- Practical fix recommendations.
+- One brief clarification round after delivery.
+
+Not included:
+
+- Certified penetration testing.
+- Compliance attestation.
+- Production infrastructure review.
+- Login, credential, cookie, or account handling.
+- Secret rotation or incident response.
+- Private repo work without explicit permission.
+- Deep refactors or feature development.
+- Unlimited back-and-forth consulting.
+
+Done means:
+
+- The report is delivered.
+- Findings are redacted and prioritized.
+- The client has enough information to decide whether to fix items themselves or request a bounded sprint.
+
+## USD 199+ Fix Sprint
+
+Included when in scope:
+
+- One public repository.
+- A bounded set of small fixes based on the delivered audit.
+- One PR or patch set.
+- Updated notes showing what changed.
+- Repo hygiene improvements such as README, SECURITY, .gitignore, env example, CI, or docs updates.
+- Small safety fixes such as safer CSP defaults, webhook verification reminders, secret-name cleanup, or agent workflow guardrails.
+
+Out of scope unless separately agreed:
+
+- Large architecture changes.
+- Production debugging.
+- New authentication or payment systems.
+- Database migrations.
+- Incident response.
+- Secret rotation.
+- Broad dependency upgrades with high regression risk.
+- Work that requires private credentials or account access.
+
+Done means:
+
+- The agreed patch or PR is delivered.
+- The change stays within the confirmed scope.
+- Local checks that are available in the repo have been run or clearly reported as unavailable.
+
+## Public-Safety Rules
+
+- Review only public repos under the standard offer.
+- Treat private repos as separate scope that requires explicit permission and confirmation before review.
+- Store no secrets.
+- Ask clients not to send credentials.
+- Redact suspicious values in reports.
+- Avoid fear-based claims or security guarantees.

docs/sales/vibe-launch-safety-sprint.md

@@ -0,0 +1,61 @@
+# Vibe App Launch Safety Sprint
+
+The Vibe App Launch Safety Sprint is a small public-repo service for builders shipping AI-assisted apps, agent tools, MCP servers, and fast launch prototypes.
+
+It focuses on obvious public-repo indicators that are easy to miss when an app is built quickly: leaked-secret patterns, risky environment examples, missing security basics, agent prompt exposure, GitHub Actions review prompts, wildcard CORS hints, webhook verification reminders, and public-readiness hygiene.
+
+This is a lightweight launch/readiness review. It is not a certified penetration test, compliance attestation, legal advice, or guarantee that a repository is secure.
+
+## Who It Is For
+
+- Solo founders preparing a public launch.
+- Indie hackers using Lovable, Bolt, Replit, Cursor, Codex, Claude Code, or similar tools.
+- Developers publishing MCP servers, agent skills, or agent-driven workflows.
+- Small teams that need a quick outside review before sharing a public repo.
+
+## Offers
+
+### USD 49 Mini Audit
+
+A report-only review for one public GitHub repository.
+
+You get:
+
+- One concise markdown report.
+- Public-repo checks for obvious leaked-secret patterns.
+- Launch-readiness checks for README, license, security policy, gitignore, CI, dependency metadata, and environment examples.
+- Agent/MCP/skill risk notes when relevant.
+- Vibe-app risk hints such as frontend-exposed secret names, Supabase service-role confusion, wildcard CORS, and webhook signature review prompts.
+- Prioritized next actions with redacted evidence.
+
+### USD 199+ Fix Sprint
+
+A bounded follow-on sprint after a mini audit is delivered.
+
+Best fit:
+
+- A few concrete repo fixes can improve launch readiness.
+- The fix can be done in a public PR or patch set.
+- The scope is small enough to define before work starts.
+
+The starting price is USD 199. Final scope and price are confirmed after the report, because not every repo has the same fix surface.
+
+## Validation Slots
+
+A few free validation slots may be offered to strong public-fit repos while FreeCodex validates the workflow. These are limited exceptions, not the standard paid offer.
+
+## Payment Timing
+
+First-contact outreach never includes payment links. Payment details are shared only after a positive reply, scope confirmation, and consent to proceed.
+
+## Turnaround
+
+Typical mini-audit turnaround is 24-48 hours after the public repo URL, intake context, and payment status are confirmed, subject to current queue.
+
+## Boundaries
+
+The standard offer is for public GitHub repos. Private repos are not part of the standard public-safe pack and require explicit permission plus separate scope confirmation.
+
+FreeCodex does not need credentials, account access, private keys, cookies, production access, or private repo access for the public mini audit.
+
+Do not send secrets or sensitive data.