01
You choose the source
Upload a ZIP or import a selected repository through the read-only GitHub review flow.
Trust and privacy
Security review without handing over blind trust.
Before Users runs a bounded static review of your ZIP or read-only GitHub repository to identify launch risks before real users touch the product.
Scan boundaries
What the review does
02
The project is indexed
The review reads file paths, bounded text files, package manifests, lockfiles, and configuration signals.
03
No code is run
Uploaded or imported code is not executed, imported, installed, or used to run package-manager commands.
04
A report is generated
Findings are organized into a temporary report with masked evidence, launch blockers, warnings, and hardening suggestions.
Storage model
What may be stored
The service stores only the limited scan details needed for account ownership, usage limits, and operational review. Long-term raw project contents are not required to generate the current report.
+Account user ID for ownership and scan limits
+Source type, such as ZIP or GitHub
+Repository name and branch/ref when the source is GitHub
+Scan date, launch status, readiness score, and finding counts
+Waitlist email and optional context if you submit the waitlist form
Data boundaries
What is not stored as product history
The review model is designed around temporary processing, masked evidence, and sanitized report data.
-Uploaded ZIPs as long-term product records
-Fetched repository contents as long-term product records
-Raw secret values
-Private GitHub tokens or private key material in the browser
-Full source-code copies in saved product history
GitHub permissions
Read-only import in this version
GitHub import lets you review a selected repository without granting permission to change code during the import flow.
Repository contents are read only to run the static review.
No comments are posted during GitHub import.
No pull requests are created during import.
No repository files are modified.
GitHub import in this version is designed around read-only review.
Review coverage
What the static review checks
The review focuses on launch-blocking and launch-adjacent risks that commonly appear in AI-built SaaS projects.
Secrets and credentials
Looks for committed env files, private keys, service-role keys, database URLs, and provider tokens with masked evidence.
Auth and ownership
Flags routes where IDs, destructive methods, admin areas, or ownership checks may need server-side verification.
Supabase patterns
Reviews service-role exposure, RLS signals, broad grants, permissive policies, and storage hints.
Stripe workflows
Checks secret-key exposure, webhook verification patterns, client-trusted payment inputs, and subscription update signals.
Config and headers
Looks for wildcard CORS, debug flags, source-map exposure, and missing security-header posture.
Dependencies
Reviews lockfiles, broad versions, install scripts, package risk signals, and deterministic advisory matches.
Risky code patterns
Uses static rules for patterns like dynamic code execution, unsafe redirects, client-side role checks, and permissive APIs.
Limitations
What this is not
A static pre-launch review can reduce obvious launch risk, but it cannot prove complete security or replace deeper review for sensitive systems.
Not a penetration test
Not a compliance approval
Not runtime monitoring
Not a proof of complete security
Not a replacement for expert review on high-risk products
Report safety
Sanitized output, careful sharing
Reports are designed to be useful for teammates without turning findings into a new disclosure risk.
+Sanitized Markdown export uses the current report data only.
+Potential secret evidence is masked before display or export.
+Exports should be reviewed before sharing with teammates.
+The report uses launch-blocker language rather than making absolute security claims.
Review any exported report before sharing it outside your team, especially when findings mention credentials, private routes, or customer data paths.
Responsible use
Scan projects you own or have permission to review.
The product is built for founders, builders, and teams reviewing their own pre-launch applications. Do not upload third-party code or private repositories unless you have explicit permission to review them.
Ready when you are
Start with one bounded review, then open the full report.
You stay in control: review the findings, read the evidence, and decide what to fix before launch.