yof is open. Check your live app for leaked keys and open databases.Start free

yof by sōtem · Web check open

Your AI built it. yof checks it, explains it, guards it and watches it.

No account needed. yof reads what any visitor's browser can see. For the full report, sign up and show the app is yours.

Your code's best friend. Catches leaked keys, open databases and risky changes before you ship.

Free for your own apps, private, any AI.

acme/my-shopPR 4821/3
yofbotsupabase/migrations/0003_customers.sql

Fix nowAnyone can read your customers' emails

Your customer list is open to the public. Anyone who finds your app's address can download every email in it.

create table customers (id uuid primary key, email text, user_id uuid);
+ alter table customers enable row level security;
+ create policy own_row on customers for select using (auth.uid() = user_id);
Copy fix for your AIc
AI
Your AIcoding agent9f2c4a1

Turned on row level security. Each person can now read only their own row.

yofbotPassed

Checked again. The table is closed. Nothing else changed.

acme/my-shopPR 4821/3
yofbotsupabase/migrations/0003_customers.sql

Fix nowAnyone can read your customers' emails

Your customer list is open to the public. Anyone who finds your app's address can download every email in it.

create table customers (id uuid primary key, email text, user_id uuid);
+ alter table customers enable row level security;
+ create policy own_row on customers for select using (auth.uid() = user_id);
Copy fix for your AIc
AI
Your AIcoding agent9f2c4a1

Turned on row level security. Each person can now read only their own row.

yofbotPassed

Checked again. The table is closed. Nothing else changed.

Preview: how yof will work

AI writes fast. Mistakes ship faster.

An assistant can build a whole app in an afternoon. It can also leave a door open without telling you. yof follows every change and brings it back to one clear answer: safe to share, or what to fix first.

01 Catch

Find the open doors before someone else does

yof will look at your app the way a stranger would, and list what is exposed: keys, customer data, pages without a lock.

Preview: how yof will work
acme/my-shopPR 4821/3
yofbotsupabase/migrations/0003_customers.sql

Fix nowAnyone can read your customers' emails

Your customer list is open to the public. Anyone who finds your app's address can download every email in it.

create table customers (id uuid primary key, email text, user_id uuid);
+ alter table customers enable row level security;
+ create policy own_row on customers for select using (auth.uid() = user_id);
Copy fix for your AIc
AI
Your AIcoding agent9f2c4a1

Turned on row level security. Each person can now read only their own row.

yofbotPassed

Checked again. The table is closed. Nothing else changed.

Start free

02 Explain

Plain words, and a fix you can paste

Every finding will say what is wrong, why it matters to you and how urgent it is. Then yof writes the fix as a prompt for the AI you built with.

Preview: how yof will work
Ask yof about this findingmy-shop.appMostly healthy

Findings

Open findings9
Fix now2
Fix this week3
Nice to have4
Passed31

Rules

.yof.yml2
Fix nowToday2
YF-12 · supabase
Anyone can read your customers' emails
Your customer list is open to the public. Anyone who finds your app's address can download every email in it.
Fix nowdatabaseauth
YF-14 · src/lib/ai.ts
Leaked keys
Keys and passwords anyone can copy from your code.
Fix nowkeys
Fix this weekThis week3
YF-03 · app/api/admin
The admin page opens without signing in
Admin pages and routes that open without signing in.
Fix this weekroutes
YF-07 · package.json
Update a package to its safe version
Parts of your app with a published weakness.
Fix this weekdepsCVE
YF-09 · middleware.ts
How urgent
Fix now, fix this week, or nice to have.
Fix this weekroutes
Nice to haveThis week4
YF-21 · app/layout.tsx
Shared links show no title or picture
What could really happen, like a bill, a leak or a broken page.
Nice to haveseo
YF-22 · package.json
No made-up or unsafe packages
Add-ons your AI invented, or a lookalike of a real one.
Nice to havedeps
YF-25 · next.config.js
Everyday words
What happened, not the technical name.
Nice to haveheaders
Ask yofFix now
What does this mean?
Your app keeps customer details in a database. Right now it has no lock, so anyone can read it. The fix adds a lock so each person sees only their own details.
Ask yof about this findingCopy fix for your AI
Start free

03 Guard

A guard that follows your rules

Guard is a GitHub App with a rules file. On each pull request it leaves one comment and a check that fails when something must be fixed. It never pushes, merges or deletes anything.

Preview: how yof will work
Openfeat(account): delete account endpointacme/my-shop · PR 91 · 3 filesyof Guard check failed
Findings
app/api/account
  route.ts 1
  route.test.ts
lib
  auth.ts
.yof.yml
Your rules
RelaxedBalancedStrict
app/api/account/route.ts-0+2viewed
18export async function DELETE(req: Request) {
19 const { id } = await req.json();
20 await db.account.delete({ where: { id } });
21 return Response.json({ ok: true });
22}
18export async function DELETE(req: Request) {
19 const { id } = await req.json();
20 const user = await currentUser(req);
21 if (user?.role !== "admin") return forbidden();
22 await db.account.delete({ where: { id } });
23 return Response.json({ ok: true });
24}
yofbotyof Guard check failed

This change lets anyone delete accounts.

+ const user = await currentUser(req);
+ if (user?.role !== "admin") return forbidden();

Suggested change. yof never commits it for you.

.yof.ymlFrom .yof.yml in your project
profile: balanced block: - secret_leak - open_database - auth_bypass warn: - missing_meta - outdated_package never: - push - merge - delete # reviewed like code
Start free

04 Watch

Still watching after launch

Once your app is live, yof will check it every day and send one short email: all good, or the one thing to fix.

Preview: how yof will work
App health/OverviewCheck now
Overview
Check history by appFix now · Fix this week · Passed
web28/30
api42/42
auth13/14
workers9/9
Findings over timewebapiPassed
Findings by severity
Fix now2Fix this week3Nice to have4Passed31
See the dashboard preview

Any AI

Works with no AI. More AI choices later.

yof sits in the middle of your app. Pick how much AI it uses; the checks around it stay the same.

No AI

The key check, the package check and the security-hole check need no AI at all.

AI on your computer

Not available yet. Later, a model running on your own computer, so your code never leaves it.

Your own AI key

Not available yet. Later, the AI service you already pay for, with the key kept on your computer.

sōtem AI: included in your sōtem plan

Our own engine, included in your sōtem plan with a monthly allowance. Starts once that engine serves customers.

For developers

Keys and packages, checked in your terminal

yof's command line tool is open source and free. It runs rules on your machine, needs no account, and catches leaked keys and made-up, lookalike or brand-new packages. Use it once, on every commit or in GitHub Actions.

A real run: npx @yof/cli check
Recorded from the published CLI on a test folder with a made-up key and package names. yof never prints a key in full.
$ npx @yof/cli check

Checks the current folder. Nothing to set up.

Only package names and pinned versions leave your computer, for public registry lookups; --offline turns that off. Also --json and --profile relaxed, balanced or strict.

Source on GitHubAdd Guard to GitHub

  • Before every commit

    One command adds a pre-commit hook. It checks what you are about to commit and stops the commit if a key would leak.

  • On every pull request

    Guard, our GitHub App, leaves one comment that updates in place and a check that fails when something must be fixed. It blocks a merge only if you make that check required.

  • In your own CI

    The GitHub Action runs yof check on every push and pull request, and fails the job when something must be fixed now.

Promises

What yof promises

  • Your code stays yours

    The CLI runs on your computer and sends no code anywhere. Guard reads only a pull request's changed files, on our hosting in Frankfurt (EU), to write its comment. It keeps the repository name, pull request number, commit, status and number of findings, never your code.

  • No telemetry

    The CLI sends nothing about you or your project to anyone, us included.

  • Keys stay hidden

    yof never shows a key in full: only its start and four characters, enough to know which key it is.

  • Open source (Apache 2.0)

    The CLI's code is public at github.com/yof-dev/yof, so anyone can read exactly what it does. Free for your own apps. Team dashboard and history in sōtem.

  • Only reads public pages

    On a live site it never attacks, logs in or floods anything.

  • Honest about limits

    It can't prove an app is completely safe. It says what it checked and what it didn't.

Check your live app today

Leaked keys, open databases, exposed files and more, with a fix for your AI.

Start freeSee the dashboard previewAlready have an account? Sign in
yof by sōtem: check your app before you share it