Repolode
Submit
Junhan2

Junhan2/reaproof

A one-command CLI that rates how exposed a shipped app's build output is to AI reverse-engineering agents like rea, and fixes what it safely can.

View on GitHubWebsite
Stars
10
Forks
2
Open issues
0
Last commit
19 days ago

What is it?

Reaproof scans the build output of a web, desktop or mobile app before release and reports what an AI reverse-engineering agent such as rea could lift from it. It looks for leftover source maps that contain original source text, server-only API keys, .env values that ended up in shipped files, .git folders, debug symbols, and development-only build flags such as Android debuggable or Electron fuses. Each finding is rated by severity and comes with a plain-language explanation and the fix to apply.

The tool only reads by default. It lists the source map files it can remove, asks for confirmation, and moves them to a backup that the undo command can restore. Without a terminal, such as in CI or an agent shell, it changes nothing and exits with a code that a release pipeline can act on. Results can also be written as JSON for agents or as SARIF for GitHub code scanning.

It supports Next.js, Vite, Nuxt, SvelteKit, Astro, React Router, Electron, Tauri, Android APK and AAB files, iOS IPA files, and native Mach-O, ELF, PE, .NET, Go and WebAssembly binaries. It needs Node.js 18.3 or later and has no npm dependencies.

Key features

  • 01Rates the rea risk of a build output from very high to baseline, with a per-finding explanation.
  • 02Finds source maps that expose original source and offers a reversible fix that moves them to a backup.
  • 03Detects server-only keys such as Stripe secret keys, AWS access keys and AI service keys in shipped files.
  • 04Compares .env values and CI environment secrets against what is actually shipped.
  • 05Outputs JSON for agents and SARIF for GitHub code scanning, with exit codes for release gating.

Use cases

  • Checking a Next.js or Vite web build for leaked source maps and API keys before deploying.
  • Gating a CI release pipeline so that critical or high findings stop the build.
  • Auditing an Electron, Tauri or Android release package before distributing it to users.
  • Letting a coding agent run the check and fix flagged issues in a project.

Quick start

  1. 1

    Run the tool in your project folder (no install needed)

    npx reaproof

Things to know

  • It needs Node.js 18.3 or later.
  • It can only rate a build; it cannot show that nothing leaks, since a rating of baseline does not mean the app is fully hidden.

In collections

AI agent skill librariesCLI & terminal toolsSecurity scanners, audits & threat intel toolsTesting frameworks & test automation tools

Topics

#security#reverse-engineering#source-maps#secrets#cli#ci-cd#devops#agent-skills#claude-code-plugin#electron

FAQ

What is reaproof?
A one-command CLI that rates how exposed a shipped app's build output is to AI reverse-engineering agents like rea, and fixes what it safely can. Reaproof scans the build output of a web, desktop or mobile app before release and reports what an AI reverse-engineering agent such as rea could lift from it. It looks for leftover source maps that contain original source text, server-only API keys, .env values that ended up in shipped files, .git folders, debug symbols, and development-only build flags such as Android debuggable or Electron fuses. Each finding is rated by severity and comes with a plain-language explanation and the fix to apply.
Is reaproof free to use? What license does it have?
reaproof is open source under the MIT license. Check the license terms before using it in commercial products.
Is reaproof still maintained?
Actively maintained. The last commit to reaproof was on Oct 19, 2026.
What can I use reaproof for?
Checking a Next.js or Vite web build for leaked source maps and API keys before deploying. Gating a CI release pipeline so that critical or high findings stop the build. Auditing an Electron, Tauri or Android release package before distributing it to users. Letting a coding agent run the check and fix flagged issues in a project.
How do I install reaproof?
Run the tool in your project folder (no install needed): npx reaproof
Where can I get reaproof?
The source code and installation instructions are on GitHub: https://github.com/Junhan2/reaproof

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects