━━ policy pack
chhhee10/deploy-guard
failproofai policy pack — guardrails for repos an agent can ship from. Install: failproofai policies add chhhee10/deploy-guard
packs are published by their authors, not audited by failproof ai. read the source before you install.[ read more ↓ ]
━━ take part of it
with no flags you get the pack's own defaults and are shown the rest — what its author marked safe to switch on unattended, not everything it contains. these three skip that.
- one policy
- one category
- look first
━━ 9 policies · 3 categories
deploys3
- block-prod-deploy
Block one-command deploys to production (vercel, fly, netlify, wrangler, serverless, eb)
- block-mutable-image-push
Block docker push of a mutable tag (:latest, :prod, :stable) — push an immutable tag instead
- warn-migration-deploy
Ask for a rollback plan before running a database migration
data3
- block-remote-db-shell
Block database shells pointed at a non-local host
- block-unscoped-sql-write
Block DROP / TRUNCATE and any DELETE or UPDATE with no WHERE clause
- warn-bulk-export
Flag a query that writes rows out to a file
repo hygiene3
- require-conventional-commit
Require a Conventional Commits prefix on every commit message
- block-lockfile-delete
Block deleting a lockfile — regenerating one silently moves every transitive dependency
- block-ci-config-edit
Block edits to CI workflow files — the thing that checks the work should not be edited by it
the hub reads this pack's manifest and verifies it against the release's own SHA256SUMS. it never downloads or runs failproofai-pack.mjs — what you see here is what policies add would install.
━━ review before you install
packs are published by their authors. failproof ai does not review, audit, or certify them, and listing here is not an endorsement. the hub checksums every pack against the SHA256SUMS in its own release — that proves the file is the one that release published, and nothing else. it is not a signature: whoever controls the release controls both files, so it says nothing about who wrote the code, and nothing about whether the code is safe.
read the source before you install. a policy runs inside your agent's hook path on every call it matches, and sees the tool input your agent is about to act on. treat a third-party pack exactly as you would any other dependency you are about to give that access to.
this pack's source: chhhee10/deploy-guard ↗ · preview what it contains without downloading or running any of it with failproofai policies show chhhee10/deploy-guard.