Marketing mission control — a single home base where marketers run their AI-assisted and manual marketing work: campaigns, copy, scheduled sends, channel integrations.
Pre-launch. Target launch: this week. See
LAUNCH_CHECKLIST.md for the runbook and
.github/workflows/launch-readiness.yml
for the automated audit → harden → package pipeline.
A web app where a marketer can:
- brief a campaign once,
- co-write copy with an AI assistant,
- send / schedule across email and social,
- and see what's running, what's drafted, and what's performing.
- Next.js 15 + TypeScript + Tailwind + shadcn/ui
- Postgres (Neon) + Prisma
- Auth.js (email + Google)
- Anthropic Claude for AI assist
- Resend for transactional + marketing email
- Inngest for scheduled jobs
- Sentry + pino for observability
- Vercel for hosting
cp .env.example .env
# fill in DATABASE_URL, AUTH_SECRET, ANTHROPIC_API_KEY, RESEND_API_KEY
# with docker
docker compose up --build
# or natively (once package.json exists)
npm install
npm run devApp runs at http://localhost:3000.
Every push runs three stages:
- Audit —
scripts/launch/audit.shinventories what's missing (auth, tests, health checks, docs, etc.) and writeslaunch-readiness-report.md. PRs get the report as a comment. - Harden — Gitleaks (secrets), Trivy (deps + image vulns), Semgrep
(OWASP Top 10), plus
scripts/launch/harden.shfor in-repo controls (Dockerfile non-root, pinned actions, security headers, rate limiting, etc.). Results flow into the GitHub Security tab. - Package — Builds a multi-stage Docker image, generates a CycloneDX
SBOM, scans the built image, and publishes both a container to GHCR
and a versioned
.tar.gzbundle.
The audit fails the workflow on main if any critical gap remains.
Built image is published to:
ghcr.io/mattdani21/mission-control:<version>
Release bundles are attached to the workflow run as artifacts.
See SECURITY.md.
MIT — see LICENSE.