-
Can a fork PR's artifact get executed by your privileged workflow?
Paste your GitHub Actions workflow YAML and find a workflow_run job that downloads an artifact and later executes something from it, plus a download-artifact step with no name…
-
Can a fork PR poison your GitHub Actions cache?
Paste your GitHub Actions workflow YAML and find actions/cache steps reachable from pull_request_target/workflow_run, and restore-keys fallbacks that can adopt a poisoned prefix…
-
Which of your Actions jobs leave the GITHUB_TOKEN in .git/config?
Paste your GitHub Actions workflow YAML and find every actions/checkout step without persist-credentials: false, with jobs that also upload artifacts (the artipacked pattern)…
-
Is your GitHub Actions workflow open to a pwn request or script injection?
Paste your GitHub Actions workflow YAML and find pull_request_target/workflow_run 'pwn request' checkouts and shell script-injection from untrusted ${{ github.event }}…
-
What will this GitHub Actions workflow cost you a month?
Paste a GitHub Actions workflow and see projected monthly billable minutes and cost, with the macOS 10x multiplier and cron costs flagged. Runs in your browser.
-
Does your GITHUB_TOKEN use least-privilege permissions?
Paste your GitHub Actions workflow YAML and find every workflow or job with no explicit permissions block (running on the ambient default) or permissions: write-all. Free, runs in…
-
Is your red GitHub Actions check even real?
Paste the JSON from a GitHub Actions run and find out in one click whether a red check is a real failure or GitHub silently never assigned it a runner. Free, runs in your browser…
-
Which of your GitHub Actions steps run on a deprecated Node runtime?
Paste your GitHub Actions workflow YAML and list every actions/* step pinned to a major that runs on a deprecated Node runtime (Node 12 or 16) or that GitHub has shut down. Free…
-
Will your GitHub Actions schedule cron actually run when you think it will?
Paste your GitHub Actions workflow YAML and find every schedule cron that is invalid, faster than GitHub's 5-minute minimum, or pinned to the top of the hour where scheduled runs…
-
Does your GitHub Actions workflow leak a secret GitHub's own masking can't catch?
Paste your GitHub Actions workflow YAML and find the two documented ways a secret slips past GitHub's own log masking: transforming it (base64/hex/substring) before printing, and…
-
Does secrets: inherit hand your secrets to the wrong workflow?
Paste your GitHub Actions workflow YAML and find every secrets: inherit call that hands your whole secret set to an external reusable workflow, or to a job a fork can trigger…
-
Is your self-hosted GitHub Actions runner exposed to a fork?
Paste your GitHub Actions workflow YAML and find every job that runs on a self-hosted label in a workflow triggered by pull_request, pull_request_target, workflow_run, or…
-
Which of your GitHub Actions jobs can hang for 6 hours?
Paste your GitHub Actions workflow YAML and find every job with no timeout-minutes (or one set to the 360-minute default) — the jobs that can hang for six hours of billed runner…
-
Does your pinned workflow load something unpinned underneath it?
Paste a GitHub Actions workflow and check whether a reusable workflow or composite action it pins to a commit SHA itself loads a third-party action by a mutable tag underneath — a…
-
Does your AI coding agent's instruction file still match your repo?
Paste AGENTS.md or CLAUDE.md and find referenced file paths that no longer exist, undefined npm scripts and shell footguns. Free, runs in your browser.
-
Is your AI coding agent's permission config over-broad?
Lint Claude Code settings.json or MCP configs for blanket Bash allow rules, plain-http MCP URLs and hardcoded secrets. Free, runs in your browser.
-
Agent Workroom: a 3D room for your AI agents' tasks
Walk around a 3D room where each AI coding agent has a desk and every task sits on the wall. Add and move tasks by voice or text, and pull progress from a GitHub repo's pull…
-
Is your AI coding plan actually cheaper than the API?
Is your Claude Max, Cursor, GitHub Copilot, or ChatGPT Plus plan actually cheaper than paying per token through the API? Enter your own usage and rates and see the monthly cost…
-
Which AI crawlers can actually read your site?
Paste your robots.txt and find out in one click whether GPTBot, ClaudeBot, Google-Extended, PerplexityBot, and 11 other named AI crawlers are allowed, blocked, or partially…
-
Android Data Safety Checker
Free, browser-local checker: scans your AndroidManifest.xml permissions and Gradle dependencies for known analytics/ads/crash SDKs, and compares them against the Data safety…
-
App Store & Google Play Listing Checker
Free tool: paste your App Store or Google Play listing text and check it before you submit — character limits, wasted keyword-field characters, repeated words, promotional claims…
-
What does the App Store really cost you versus web checkout?
Enter your monthly app revenue and average in-app price and see what Apple (30% or 15%), Google Play and web checkout via Stripe or Paddle take, your net payout, 12-month totals…
-
App Store Screenshot & Icon Checker
Free tool: drop your App Store Connect or Google Play listing images in and check them before you upload — app icon transparency (the classic "can't contain an alpha channel"…
-
What will authentication cost at your user count, and who is cheapest?
Enter your monthly active users and see what Clerk, Auth0, AWS Cognito, Firebase, Supabase Auth and WorkOS charge, the 12-month spend under your growth rate, and the user count…
-
Why did my AWS bill go up this month?
Paste the CSV from AWS Cost Explorer for two months and see which services explain the rise in your AWS bill, ranked, with partial-month normalisation and a checklist of common…
-
AWS Commitment Break-Even Calculator — how much to commit, not just whether
Free AWS Savings Plan and Reserved Instance calculator. Paste your hourly or daily usage and each option's discount to find the commitment that saves the most, its break-even…
-
AWS IAM Policy Risk Check — free, private, paste-the-policy
Free AWS IAM policy checker: paste a policy, trust policy or bucket policy and see admin wildcards, privilege-escalation actions, NotAction grants and public principals with fixes…
-
Backup File Exposure Checker
Enter a site URL to test eight well-known backup filenames (backup.zip, db.sql and more) for a publicly served site or database backup. Nothing uploaded to us.
-
Why is your BigQuery bill so high?
Paste your BigQuery query groups (runs per month, GB billed, slot-hours) and see on-demand vs Editions cost, the expensive queries to cap with maximum_bytes_billed, and repeat…
-
Has your branch protection drifted from policy?
Paste your repo's GitHub branch protection settings and declared policy to find every rule that has drifted weaker than intended. Free, nothing uploaded.
-
CAA Record Checker
Enter a hostname to see the CAA record set that governs certificate issuance per RFC 8659, and which CAs may issue. Only public DNS is read; nothing uploaded.
-
Cache-Control Checker
Free tool: run a CLI that sends one real request to your site, then paste the JSON here for a plain-English report on Vary: * (uncacheable forever), Cache-Control: public…
-
Canonical Tag Checker
Free tool: fetch a URL for real and get a plain-English report on canonical-tag misconfigurations -- conflicting tags, a canonical pointing at a different domain, or a canonical…
-
Caption Quality Checker
Free tool: paste an SRT or WebVTT caption file and check it against commonly-used caption style-guide thresholds -- reading speed (characters per second), line length, lines per…
-
Which cargo audit findings actually matter?
Paste cargo audit --json and your Rust source: see which flagged crates your code actually uses and which are test-only or unreferenced noise. Free cargo audit triage, runs in…
-
What will a CDN cost at your GB-per-month bandwidth, and who is cheapest?
Enter your monthly CDN bandwidth (GB delivered) and see what Amazon CloudFront, Google Cloud CDN, Fastly, Bunny CDN and KeyCDN charge, the 12-month spend under your growth rate…
-
Chrome Extension Permission Checker
Free, browser-local checker: scans your extension's JavaScript/TypeScript source for chrome.* API usage and compares it against manifest.json's declared permissions, so an unused…
-
What will CI cost at your build-minute volume, and who is cheapest?
Enter your monthly build-minute volume and see what GitHub Actions, CircleCI, GitLab, Bitbucket Pipelines and Buildkite charge, the 12-month spend under your growth rate, and the…
-
Split your CI tests into evenly timed shards
Paste JUnit XML from pytest, Jest, Go, Maven/Gradle or RSpec and get an even split into N CI shards, the slowest-shard time, billed-minute savings, the best shard count, and…
-
Claude Code Hooks Security Check
Paste a Claude Code hooks configuration and see which command strings match known-dangerous shapes: a remote download piped straight into a shell, a credential file read and sent…
-
Claude Code Settings Check
Paste a Claude Code settings.json to find hooks that never fire and permission rules that never match: bad matchers, typos, duplicates. Runs in your browser.
-
Claude Code Subagent Check
Paste a Claude Code subagent definition and find why it never gets delegated to: bad name, vague description, wrong tools or model. Runs in your browser.
-
Claude Skill Scaffold Generator
Describe what a Claude Agent Skill should do and get a starter SKILL.md with valid frontmatter, a folder layout and authoring checks. Runs in your browser.
-
Cloud Bucket Exposure Checker
Free tool: run a CLI that sends one real, read-only request to an AWS S3 bucket, a Google Cloud Storage bucket, or an Azure Blob container you name, then paste the JSON here for a…
-
What will your Cloudflare bill be, and what cuts it most?
Estimate a monthly Cloudflare developer-platform bill from your own usage (Workers requests and CPU time, KV reads and writes, R2 storage and operations) at editable list prices…
-
Why is your CloudWatch Logs bill so high?
Paste your CloudWatch log groups (stored GB, retention, GB ingested per month) and get what each costs, the retention policy to set, dead groups and Infrequent Access candidates…
-
CODEOWNERS Shadow Checker
Free tool: paste your CODEOWNERS file and your repo's file list to see exactly which earlier, more specific rules a later, broader rule silently overrides -- GitHub's own…
-
Cookie Security Checker
Free tool: run a CLI that sends one real request to your site, then paste the JSON here for a plain-English report on SameSite=None cookies missing Secure (which current browsers…
-
CORS Misconfiguration Checker
Free tool: run a CLI that sends real requests with crafted Origin headers to your API, then paste the JSON here for a plain-English report on reflected-origin, null-origin, and…
-
Did this PR drop your coverage?
Paste two Cobertura or JaCoCo coverage XML reports — baseline vs this PR — and see whether line coverage dropped, and which files got worse. Free, runs in your browser, nothing…
-
Will your cron job survive daylight saving?
Paste a cron expression and timezone to see which runs a daylight-saving change skips or doubles, and how UTC-only schedulers drift. Runs in your browser.
-
CSV to SQL, in your browser
Convert a CSV to SQL: CREATE TABLE with inferred column types plus batched INSERT statements for PostgreSQL, MySQL, SQLite, SQL Server and BigQuery. Free, runs in your browser…
-
Why is your Databricks bill so high?
Paste your Databricks clusters (kind, DBUs used, autotermination) and get what each costs, scheduled work running on pricier all-purpose compute, clusters that never terminate and…
-
What will your Datadog bill be, and what cuts it most?
Estimate a monthly Datadog bill from your own usage (hosts, containers, custom metrics, logs, APM, synthetics) at editable list prices, and see which changes cut it most, with a…
-
Is Dependabot actually watching all of your repo?
Paste your dependabot.yml and your repo's file list. Finds ecosystems Dependabot never updates, invalid intervals, duplicate entries, missing groups and cooldown, and writes a…
-
Could a public package be substituted for your internal one?
Paste your requirements.txt, pip.conf, package.json, and .npmrc and find the two configuration shapes behind every 2021 dependency-confusion incident: pip --extra-index-url, and…
-
Deploy Concurrency Check
Paste a GitHub Actions workflow and see every way it is allowed to apply an older revision over a newer one: no concurrency group, a group that changes every run…
-
devsec-toolkit: every DevSecOps check in one free command
One zero-dependency command that runs your repository through 23 open-source DevSecOps checks: GitHub Actions injection and poisoning, Docker and Compose, Kubernetes, dependency…
-
DMARC Report Reader — read rua reports without a SaaS
Drop your DMARC aggregate reports (.xml, .gz or .zip) and see which senders pass SPF and DKIM alignment, which fail and exactly why, and when it is safe to move from p=none to…
-
Is your Dockerfile's base image still supported?
Paste your Dockerfile and find every FROM line whose base image release has passed its own end-of-life date. Free, runs in your browser, nothing uploaded.
-
Are your Dockerfile base images pinned to a digest?
Paste your Dockerfile and find every FROM line referencing a base image by a mutable tag like node:18 instead of a pinned content digest (@sha256:...). Free, runs in your browser…
-
Is a secret baked into your Docker image?
Paste your Dockerfile and find every ENV or ARG instruction whose name looks like a secret, and every COPY/ADD of a credential file like .env or id_rsa into the build. Free, runs…
-
Is your Dockerfile busting its own build cache?
Paste a Dockerfile and see whether its instruction order defeats Docker's layer cache, from late dependency installs to a lone apt-get update. Runs in your browser.
-
What is your docker-compose.yml handing to the host?
Paste your docker-compose.yml and find risky settings: privileged: true, docker.sock mounts, network_mode host, cap_add SYS_ADMIN, databases on 0.0.0.0, literal secrets, :latest…
-
Dotenv Exposure Checker
Paste your site's URL to see whether its .env file is publicly reachable. Reports which variable names are declared, never their values. Free, runs from your browser or a CLI…
-
Find copy-pasted code, fast
Drop a project folder and see every copy-pasted block: file, lines and the matching copy. A Rust copy-paste detector compiled to WebAssembly. Nothing is uploaded. Also a CLI that…
-
Is your DynamoDB table on the wrong capacity mode?
Paste a DynamoDB table's consumed read and write capacity from CloudWatch and see what it costs on-demand, provisioned with autoscaling and provisioned at a fixed peak. Free, runs…
-
Are your EBS volumes the wrong type?
Paste your EBS volumes (type, size, provisioned and peak IOPS) and get the cheapest volume type that still covers the peak, the aws ec2 modify-volume command, gp2 burst risk and…
-
What will transactional email cost at your send volume, and who is cheapest?
Enter your monthly send volume and see what Resend, Postmark, SendGrid, Mailgun, Amazon SES and Brevo charge, the 12-month spend under your growth rate, and the volume where the…
-
Email Authentication Checker (SPF, DKIM, DMARC, BIMI)
Free SPF, DKIM, DMARC and BIMI checker: paste any domain and get a plain-English report on why your email might be going to spam, with the exact DNS record read and what it means…
-
Does your .env.example still match what the code actually reads?
Paste your .env.example and your source code and see every environment variable the code reads (process.env, os.getenv, os.environ, ENV[], System.getenv) that the example file…
-
What will error tracking cost at your event volume, and who is cheapest?
Enter your monthly event volume and see what Sentry, Rollbar, Bugsnag, Honeybadger and GlitchTip charge, the 12-month spend under your growth rate, and the volume where the…
-
What will feature flags cost at your requests-per-month volume, and who is cheapest?
Enter your monthly flag-evaluation volume (thousands of requests) and see what PostHog, Flagsmith and ConfigCat charge, the 12-month spend under your growth rate, and the volume…
-
Firebase Security Rules Exposure Checker
Enter a Firebase project ID to test, with read-only unauthenticated requests, which database or Firestore paths are publicly readable. Nothing uploaded to us.
-
Which of your tests are actually flaky?
Paste two or more JUnit XML test reports and find out in one click which tests are flaky (pass one run, fail the next) versus genuinely broken versus stable. Free, runs entirely…
-
If one person left tomorrow, which folders would nobody understand?
Paste your git log and see the bus factor (truck factor) of every folder: who really owns it, whether they are still active, and who to pair with. Free, runs in your browser…
-
Git Exposure Checker
Free tool: run a CLI that sends two real requests to your site (.git/HEAD and .git/config), then paste the JSON here for a plain-English report on whether your .git directory is…
-
Turn your git history into a timesheet your client can read
Paste your git log and get estimated hours per day, a client-ready work summary in Markdown or CSV, and an invoice figure at your hourly rate. Free, private, runs in your browser…
-
GraphQL Introspection Exposure Checker
Free tool: sends one real introspection query to a GraphQL endpoint URL you choose and reports whether introspection is enabled -- exposing every query, mutation, and type name…
-
Does your values.yaml actually match its own schema?
Paste a Helm values.yaml and values.schema.json to find silently ignored typos, missing required fields and type mismatches. Runs in your browser, no Helm needed.
-
Hidden Unicode Check
Find invisible zero-width, tag and bidi override characters hidden in CLAUDE.md, AGENTS.md, rules files or any text. Free, private, runs in your browser.
-
hreflang Reciprocity Check
Free tool: paste a page's HTML (or try fetching its alternates) and check its hreflang tags for missing reciprocal links, invalid language/region codes (en-uk vs en-GB), a missing…
-
Turn incident notes into a postmortem draft
Paste an incident log and get time to detect, acknowledge, mitigate and resolve plus a blameless postmortem draft in Markdown. Free incident timeline generator and MTTR…
-
iOS Privacy Manifest Checker
Free, browser-local checker: scans your Swift/Objective-C source for Apple's Required Reason API usage and compares it against your PrivacyInfo.xcprivacy manifest, so a missing…
-
JSON-LD Rich Result Validator — free, private, in your browser
Free JSON-LD and schema markup validator. Paste a page's HTML or JSON-LD and see every missing required and recommended property for Product, Article, LocalBusiness, Recipe…
-
JSON to TypeScript, Zod, JSON Schema and Go, in your browser
Convert JSON to TypeScript interfaces, Zod schemas, JSON Schema or Go structs. Merges many samples to find optional and nullable fields. Free, runs in your browser, nothing…
-
JWT Security Check
Paste a JWT to decode it and flag misconfigurations: alg:none, embedded keys, algorithm confusion, suspicious kid, bad exp. Free, runs in your browser.
-
Is your code verifying JWTs, or only reading them?
Paste your JavaScript, Python, Go or Java code and find JWT verification misuse: jwt.decode where verify is needed, verify_signature False, alg none, unpinned algorithms…
-
Will this manifest survive your next Kubernetes upgrade?
Paste Kubernetes manifests and find every apiVersion and kind a Kubernetes release has removed, before an upgrade rejects them. Runs in your browser.
-
What are your Kubernetes manifests handing to the node?
Paste your Kubernetes YAML and find risky pod security settings: privileged: true, hostNetwork, hostPath docker.sock, SYS_ADMIN capabilities, running as root, missing…
-
Are your Kubernetes requests wasting money?
Paste kubectl top output, kubectl get pods JSON or a simple CSV and see which containers request far more CPU and memory than they use, a recommended request with headroom, the…
-
Will this container take down its whole node?
Paste Kubernetes manifests to find containers missing memory limits, CPU requests or ephemeral-storage limits that let one pod starve a node. Runs in your browser.
-
Will your Kubernetes rollout drop live requests?
Paste a Kubernetes Deployment YAML and find every reason a rolling update can drop live requests: no readinessProbe, no preStop hook, a grace period shorter than the drain…
-
Is your Lambda memory setting costing you money?
Paste AWS Lambda CloudWatch REPORT lines and see peak memory against what you configured, duration percentiles, cold-start share, and the memory size that minimises cost without a…
-
Lambda or Fargate? Find your cost break-even
Enter requests per month, duration, memory and concurrency and compare the monthly cost of AWS Lambda, Google Cloud Run, AWS Fargate and EC2, plus the request volume where…
-
What in your app could cost you a fine, a chargeback or a surprise bill?
A free, local scan for consent, auto-renewal, disclosure, licence, leaked-key and runaway-spend problems, with the law or rule behind each finding. Observations, not legal advice.
-
Can you ship these dependencies under your license?
Paste your dependency licenses, say how you ship (closed-source app, SaaS, internal tool, or an open-source license) and see which dependencies conflict — GPL in a proprietary…
-
Did a dependency's license just change under you?
Paste two snapshots of your dependency tree's declared licenses (npm, pip, cargo, go) and find out in one click which packages changed license since the last one — the change…
-
LLM API Pricing Calculator
Compare the monthly dollar cost of calling different LLM APIs (Claude, GPT, Gemini, or a custom provider) for your own workload -- modelling fresh input, cached input, and output…
-
Which LLM calls in your code are quietly costing you money?
Paste your code and see every OpenAI, Anthropic and Gemini call with no max-tokens cap, inside a loop, on a premium model, or using a retired model name, plus a monthly cost…
-
Did the new model break your prompts?
Paste your saved LLM outputs from before and after a model swap or prompt edit and see which cases broke: invalid JSON, lost keys, new refusals, truncation, lost numbers. Free…
-
Would a spend cap have stopped your runaway LLM bill?
Stop a runaway OpenAI or Anthropic bill before it happens: hard per-user, per-feature and per-run dollar caps, an output-token ceiling, and circuit breakers that trip on agent…
-
LLM Usage Log Analyzer
Paste an LLM API usage log (JSONL, JSON or CSV) and see spend by model, feature and day, your cache hit rate, a 30-day run rate, and which levers -- caching, batch, a cheaper…
-
Build a valid llms.txt for your site, free
Paste your site's page list, a sitemap.xml, or a Markdown docs tree and get a valid llms.txt file — the emerging llmstxt.org convention that gives AI assistants a structured map…
-
Is anything in your node_modules GPL?
Paste your package-lock.json and see every dependency licence: copyleft (GPL, AGPL), unlicensed and unknown packages flagged first. Free npm license checker, runs in your browser…
-
What will logging cost at your GB-per-month volume, and who is cheapest?
Enter your monthly log volume (GB ingested) and see what Datadog Logs, Grafana Cloud Logs, Axiom, Better Stack and Papertrail charge, the 12-month spend under your growth rate…
-
MCP Config Risk Check
Paste an mcp.json, claude_desktop_config.json, or any MCP server config and get every risky pattern flagged: servers granted broad filesystem/shell access, API keys hardcoded…
-
Will this product feed get items disapproved?
Paste a Google Merchant Center or Meta Catalog feed to find missing fields, bad GTINs and malformed prices before products are disapproved. Runs in your browser.
-
Stripe or a merchant of record: what do you keep at your monthly revenue?
Enter your monthly software revenue and average sale price and see what Stripe, Stripe Tax, Paddle, Lemon Squeezy and Polar take, your net payout, 12-month totals, and the revenue…
-
Is your NAT gateway bill avoidable?
Paste your NAT gateway traffic per destination and get the monthly NAT cost, which AWS services should use a free S3/DynamoDB gateway endpoint or an interface endpoint, the net…
-
What will your Neon bill be, and what cuts it most?
Estimate a monthly Neon serverless Postgres bill from your own usage (compute CU-hours, storage, restore history, branches, data transfer) at editable list prices, and see which…
-
Do your package.json, .nvmrc, Dockerfile and CI agree on Node.js?
Paste package.json, .nvmrc, .tool-versions, a Dockerfile and a GitHub Actions workflow and see whether your Node.js versions drifted: a pin that breaks engines.node, majors that…
-
Which npm audit findings actually matter?
Paste npm audit --json and your source imports: see which vulnerable packages your code actually imports, which are only reached through a dependency, and which are test-only…
-
Did a dependency just start running code at install time?
Paste your package-lock.json and see every package that runs a preinstall, install, postinstall, or prepare script at install time -- and, with an older lockfile, exactly which…
-
Why is node_modules installing the same package five times?
Paste your package-lock.json and see every package installed at more than one version, who pulls each copy in, and which ones npm dedupe can remove. Free duplicate dependency…
-
Which of your npm dependencies lack a provenance attestation?
Paste a package-lock.json or package list to see which npm dependencies have provenance attestations and which still rely on classic publish tokens.
-
What will object storage cost for your GB stored and GB served, and who is cheapest?
Enter the GB you store and the GB you serve per month and see what Amazon S3, Cloudflare R2, Backblaze B2, Wasabi, DigitalOcean Spaces and Hetzner charge, the 12-month spend under…
-
Obsidian Plugin Review Checker
Free, browser-local checker for Obsidian plugin developers: cross-checks manifest.json against versions.json, flags leftover sample-plugin template placeholder values, and scans…
-
GitHub Actions OIDC Trust Policy Checker
Free tool: paste an AWS IAM role trust policy and see whether its GitHub Actions OIDC conditions actually restrict which repository, branch or environment can assume the role.
-
On-Call Load Analyzer — free, private, paste-the-export
Free on-call load analyzer: paste a PagerDuty, Opsgenie or Grafana OnCall incident CSV and see who carries the pager, night and weekend pages, noisy and self-resolving alerts, and…
-
Did this API version break existing clients?
Paste two OpenAPI 3.0/3.1 JSON documents and see exactly which changes would break an existing client — a removed endpoint, a parameter that became required, a narrowed type, a…
-
Does your package.json "exports" map point at files that actually exist?
Paste your package.json and a listing of the files you actually publish and see every literal target in the "exports" map that points at a file that doesn't exist -- the cause of…
-
Free on-page SEO audit that never uploads your page
Paste a page's HTML for a scored SEO and AI-readiness audit: title, description, headings, canonical, JSON-LD, alt text, each with its fix. Free, private.
-
pg_stat_statements Analyzer — free, private, paste-the-output
Free pg_stat_statements analyzer: run one read-only query, paste the result, and see which Postgres queries use the most database time, which look like N+1 loops, and which miss…
-
Are your GitHub Actions pinned to a commit SHA?
Paste your GitHub Actions workflow YAML and find every third-party action referenced by a mutable tag like @v4 instead of a pinned 40-character commit SHA. Free, runs in your…
-
Which pip-audit findings actually matter?
Paste pip-audit -f json and your Python source: see which vulnerable packages your code actually imports and which are test-only or unreferenced noise. Free pip-audit triage, runs…
-
Why is my Postgres query slow? Paste the plan.
Paste a PostgreSQL EXPLAIN ANALYZE plan (text or JSON) and see where the time went per node, missing indexes, bad row estimates and disk spills, each with a suggested fix. Free…
-
Postgres Index Auditor — free, private, paste-the-output
Free Postgres index auditor: run one read-only query, paste the result, and see unused, duplicate, redundant and invalid indexes, the disk they waste and DROP INDEX statements to…
-
PPP pricing table generator for apps and SaaS
Turn one price into a purchasing-power (PPP) price table for about 50 countries: damped discounts, a floor, .99 rounding, price tiers, regional discount groups and a revenue…
-
What will product analytics cost at your event volume, and who is cheapest?
Enter your monthly event volume and see what PostHog, Mixpanel, Plausible, Fathom and Umami Cloud charge, the 12-month spend under your growth rate, and the volume where the…
-
Which labels are inflating your Prometheus metrics bill?
Paste a Prometheus or OpenMetrics /metrics scrape and see active series per metric, the high-cardinality labels, the exact series saved by dropping each one, and a monthly cost…
-
PWA Installability Checker
Free tool: run a CLI that fetches your page, its Web App Manifest, and every icon it lists, then paste the JSON here for a plain-English report against Chrome's installability…
-
Which of your PyPI dependencies lack a provenance attestation?
Paste a requirements.txt or pyproject.toml to see which Python dependencies have PyPI provenance attestations and which rely on classic API tokens.
-
Why is your RDS bill so high?
Paste your Amazon RDS instances (class, engine, Multi-AZ, storage, IOPS, CPU) and get what each costs, Multi-AZ you pay for outside production, io1 IOPS that gp3 covers, Graviton…
-
Is your RDS instance too big?
Paste CloudWatch CPU, freeable memory and connection numbers (or describe-db-instances JSON) and see which RDS and Aurora instances are over- or under-provisioned, the next class…
-
Redirect Chain Checker
Free tool: paste the hops a URL's redirects actually took (from your browser's Network tab, or a curl -sI trace) and check for a redirect loop, a chain longer than the recommended…
-
Referrer-Policy & Permissions-Policy Checker
Check your site's Referrer-Policy and Permissions-Policy headers for unsafe-url, invalid syntax and wildcard camera or microphone access. Nothing uploaded.
-
Which regexes in your code can hang your server?
A free static ReDoS scanner for JS, TS and Python with a CI-ready CLI and an optional timing probe. No account, no upload.
-
Changelog from git commits, in your browser
Generate release notes and a CHANGELOG.md entry from git log: grouped by Conventional Commit type, breaking changes first, with a suggested semantic version bump. Free, runs in…
-
Is a required status check stuck forever on your repo?
Paste your branch protection required status checks and your GitHub Actions workflow YAML to find every required check name no job can ever report again — the reason a pull…
-
Is your requirements.txt actually reproducible?
Paste your requirements.txt and see every unpinned version, missing hash, extra index URL and unpinned git dependency. Free pip requirements pin checker, runs in your browser…
-
S3 Bucket Exposure Checker
Free tool: paste an S3 bucket name and it sends two real, unsigned GET requests -- one asking the bucket to list its own contents, one asking to read its ACL -- to name whether…
-
Is your S3 bucket in the wrong storage class?
Paste per-bucket S3 size, object count and read activity and see the monthly cost in Standard, Standard-IA, Intelligent-Tiering and Glacier Instant Retrieval, with the…
-
Will an S3 lifecycle rule actually save money?
Paste an S3 Inventory CSV and see current monthly cost by storage class and the net 12-month saving of moving objects to Standard-IA, Glacier or Intelligent-Tiering after…
-
What changed between two SBOMs?
Paste two CycloneDX or SPDX SBOM JSON files and see exactly which packages were added, removed, or changed version between two builds. Free, runs in your browser, nothing uploaded.
-
What will hosted search cost for your records and monthly searches, and who is cheapest?
Enter your record count and monthly searches and see what Algolia, Meilisearch Cloud, Typesense Cloud, Elastic Cloud and a self-hosted box cost, the 12-month spend under your…
-
Security Headers Checker
Free tool: run a CLI that sends one real request to your site, then paste the JSON here for a plain-English report on missing clickjacking protection, X-Frame-Options: ALLOW-FROM…
-
security.txt Checker (RFC 9116)
Checks a security.txt against RFC 9116 — including the expiry date that quietly turns a valid file into a stale one, which is the state most published security.txt files are in.
-
Sitemap lastmod Freshness Check
Paste a sitemap.xml and check its lastmod dates for the freshness-faking patterns Google warns about: bad formats, future dates and uniform dates. Nothing uploaded.
-
Skill Manifest Check
Lint a SKILL.md for missing frontmatter, a description too vague to trigger, overlapping triggers and body size. Free, runs in your browser.
-
SLO burn-rate alerts, generated
Enter your SLO and get the error budget in minutes of downtime, multi-window multi-burn-rate alert thresholds, how fast each alert fires in an outage, and a Prometheus rules file…
-
Did an AI assistant just suggest a package that doesn't exist?
Paste your package.json and this offline check flags any dependency name that looks like a one- or two-letter typo of a famous npm package -- the same shape as a hallucinated name…
-
Why does this text bill as 3 segments?
Paste a text message to see whether it is GSM-7 or UCS-2, how many segments it bills as, what it costs per month at your volume, and which curly quote or emoji to swap to cut the…
-
Why is your Snowflake bill so high?
Paste your Snowflake warehouses (size, credits used, AUTO_SUSPEND, resumes) and get what each costs, the AUTO_SUSPEND tail you are paying for, idle warehouses and a bounded…
-
SOC 2 Readiness Checker — free, private, no signup
Free SOC 2 readiness checker: answer the controls auditors test, get a readiness score, the gaps ranked by value per day of effort, and a rough timeline to a Type I date and a…
-
Social Preview Checker
Free tool: run a CLI that sends real requests to your page and its og:image/twitter:image, then paste the JSON here for a plain-English report on missing tags, a relative og:image…
-
Source Map Leak Checker
Free tool: paste your site's URL (or a list of JS file URLs), and it finds every script's sourceMappingURL comment, fetches the map, and names which ones are publicly readable and…
-
What will transcription cost for your audio hours, and who is cheapest?
Type your monthly audio hours and growth, get every speech-to-text API priced side by side and the volume where self-hosting Whisper starts to win. No account, no upload.
-
Will this migration take your database down?
Paste a PostgreSQL migration to find statements that lock the table: CREATE INDEX without CONCURRENTLY, SET NOT NULL, a missing lock_timeout. No database connection.
-
Subresource Integrity (SRI) Checker & Hash Generator
Free tool: generate a sha384 integrity= hash for any script or stylesheet, or run a CLI that checks a page's cross-origin tags for a missing integrity attribute, a missing…
-
Does your structured data match what's actually on the page?
Paste a page's HTML and see whether its JSON-LD (FAQPage, HowTo, Article, Product, LocalBusiness/Organization, Review) actually says, word for word, what the page's own visible…
-
Subdomain Takeover Checker
Free tool: paste a hostname and it follows its real CNAME chain, then -- if the chain ends at a known takeover-prone provider (S3, Heroku, GitHub Pages, Azure, and 20 more) --…
-
Your GitHub Pages sitemap is probably never read
A site published at a URL subpath — user.github.io/repo/, gitlab.io/project/, a CDN subdirectory — cannot govern its own robots.txt, so its sitemap is never auto-discovered and…
-
What will your Supabase bill be, and what cuts it most?
Estimate a monthly Supabase Pro bill from your own usage (compute, database disk, egress, storage, monthly active users, Edge Functions, Realtime) at editable list prices, and see…
-
Supabase RLS Exposure Checker
Free, in-browser tool: paste your Supabase project URL and anon key, and it sends a real read-only request to every table it can see, naming which ones return real rows to an…
-
Which of these resources is your terraform apply about to destroy?
Paste a Terraform plan JSON to see what an apply destroys or replaces, with a loud flag when a database, bucket or DNS record is hit. Runs in your browser.
-
What will this terraform apply add to the monthly AWS bill?
Paste a Terraform plan (terraform show -json) and get an approximate monthly AWS cost delta before you apply: top cost drivers, an honest list of what it could not price, and a…
-
Did your Terraform plan just print a secret in plaintext?
Check a Terraform structured plan for secret-shaped values the sensitive flag missed -- deterministic, no account, no upload, with a matching CLI you can run as a CI gate before…
-
What will your GPU workload cost on each GPU cloud, and when is it cheaper to buy the card?
Enter the GPU, the busy GPU-hours per month and how much of the time it is really busy, and see what RunPod, Lambda, Vast.ai, CoreWeave, AWS, Google Cloud and Modal charge, the…
-
What will your Upstash Redis bill be, and should you go fixed?
Estimate a monthly Upstash Redis bill from your own usage (million commands, storage GB, bandwidth GB) at editable list prices, see where pay-as-you-go crosses over to a fixed…
-
What will uptime monitoring cost for your monitors and check interval, and who is cheapest?
Type your monitor count, check interval and growth, get every uptime-monitoring plan priced side by side and the monitor count where the cheapest one changes. No account, no…
-
What will your Vercel bill be, and what cuts it most?
Estimate a monthly Vercel Pro bill from your own usage (bandwidth, edge requests, functions, images, builds, seats) at editable list prices, and see which changes cut it most…
-
What will video hosting cost for your minutes stored and watched, and who is cheapest?
Type your minutes stored, minutes watched per month and growth rate, get every video-hosting platform priced side by side and the viewing level where the cheapest one changes. No…
-
Did an extension you already trust just change what it does?
Paste a snapshot of your installed VS Code, Cursor, Windsurf, or VSCodium extensions and see exactly which ones changed their activation surface -- a new startup trigger, a new…
-
Why is my webhook signature failing?
Webhook signature verification failed? Paste the headers, raw body and secret to verify the HMAC for Stripe, GitHub, Shopify, Slack and Svix, and see exactly why it does not…
-
WordPress Plugin Review Checker
Free, browser-local checker for WordPress plugin developers: catches a readme.txt Stable tag that doesn't match your plugin's Version header, missing required readme/header…
-
One GitHub Action, twelve workflow risks checked
Add one free GitHub Action to scan your workflows for script injection, pwn requests, cache and artifact poisoning, leaked secrets, over-broad permissions and more. Read-only…
No tool on this page matches that. Search every tool.