06Ask yof

Ask yof what a finding means

In the yof app, ask about your own apps and findings in your own language. yof answers from what it found, and writes the fix as a prompt for your AI.

Start free AI builders

How it works, step by step

Ask yof · shop.exampleSample data

Fix nowThe customers table can be read by anyone

What does this mean?

read 1 app · 20 open findings · focus: customers table

yof · answered from your findings

Your app keeps customer details in a database. Right now it has no lock, so anyone can read it. The fix adds a lock so each person sees only their own details.

Fix prompt for your AICopy prompt

yof (a read-only safety check) found this on my app shop.example: Your Stripe secret key is in your page code.Where: https://shop.example/assets/app.js.

Fix nowThe customers table can be read by anyone

What does this mean?

read 1 app · 20 open findings · focus: customers table

yof · answered from your findings

Your app keeps customer details in a database. Right now it has no lock, so anyone can read it. The fix adds a lock so each person sees only their own details.

Fix prompt for your AICopy prompt

yof (a read-only safety check) found this on my app shop.example: Your Stripe secret key is in your page code.Where: https://shop.example/assets/app.js.

Fix nowThe customers table can be read by anyone

What does this mean?

read 1 app · 20 open findings · focus: customers table

yof · answered from your findings

Your app keeps customer details in a database. Right now it has no lock, so anyone can read it. The fix adds a lock so each person sees only their own details.

Fix prompt for your AICopy prompt

yof (a read-only safety check) found this on my app shop.example: Your Stripe secret key is in your page code.Where: https://shop.example/assets/app.js.

Fix nowThe customers table can be read by anyone

What does this mean?

read 1 app · 20 open findings · focus: customers table

yof · answered from your findings

Your app keeps customer details in a database. Right now it has no lock, so anyone can read it. The fix adds a lock so each person sees only their own details.

Fix prompt for your AICopy prompt

yof (a read-only safety check) found this on my app shop.example: Your Stripe secret key is in your page code.Where: https://shop.example/assets/app.js.

02 Explain · Says it in plain words

Plain words, and a fix you can paste

Every finding says what is wrong, why it matters to you and how urgent it is. Then yof writes the fix as a prompt for the AI you built with.

How yof works, shown with sample data

Findings

Anyone can read your customers' emails

Your app keeps customer details in a database. Right now it has no lock, so anyone can read it. The fix adds a lock so each person sees only their own details.

supabase/migrations/0003_customers.sql

  create table customers (id uuid primary key, email text, user_id uuid);  -- row level security: off

LovableCursorv0BoltAny AICopy fix for your AI

yof (a read-only safety check) found this on my app shop.example: 
the customers table can be read by anyone. Turn on row level security for the table and add a policy so each 
person can read only their own row (auth.uid() = user_id).+ alter table customers enable row level security;+ create policy own_row on customers for select using (auth.uid() = user_id);

Urgency

Fix nowCWE-284 · OWASP A01

App

Appshop.example

FindingYF-5E2F

FoundYesterday

Everyday wordsWhat happened, not the technical name.
Why it mattersWhat could really happen, like a bill, a leak or a broken page.
How urgentFix now, fix this week, or nice to have.
Copy fix for your AIA ready prompt for the assistant you already use.
Ask yofAsk what a finding means, in your own language.

Start free

yof and your AI

yof explains it. Your AI or Patch fixes it. You decide.

Each finding in plain words
What is wrong and what could happen, without the technical name.
Your Stripe secret key is in your page code (/assets/app.js)Anyone can use it to take payments, give refunds and read your customers' payment details.

A fix prompt for your AI

yof writes the prompt. You paste it into the tool you built with.

fix-prompt.txt

yof (a read-only safety check) found this on my app shop.example: Your Stripe secret key is in your page code.

Where: https://shop.example/assets/app.js.

The value starts like this (shortened on purpose): sk_live_****9f2a

Find where this comes from in the code and change it at the source.

Patch opens the pull request
Always as a draft. Patch checks its own change first, and you merge.
Patch: upgrade minimist 1.2.5 to 1.2.6 (security fix)
- package.json still parses
- no open-ended range (no >=, * or latest) for minimist
- the vulnerability rule no longer fires at the new lowest allowed version (package.json dependencies: ^1.2.6)
Ask yof
In the yof app, ask about your own apps and findings. It answers from what it found.

Real output from the sample report of shop.example, a made-up site. The sample is in English. See a sample report

Any AI

Works with no AI. More AI choices later.

yof sits in the middle of your app. Pick how much AI it uses; the checks around it stay the same.

No AI

The key check, the package check and the security-hole check need no AI at all.

AI on your computer

Not available yet. Later, a model running on your own computer, so your code never leaves it.

Your own AI key

Not available yet. Later, the AI service you already pay for, with the key kept on your computer.

yof AI: our own engine

Our own engine, no outside AI provider, with a monthly allowance. Starts once that engine serves customers.

Use yof inside your AI builder

Ask yof what a finding means

How it works, step by step

Plain words, and a fix you can paste

yof explains it. Your AI or Patch fixes it. You decide.

Each finding in plain words

A fix prompt for your AI

Patch opens the pull request

Ask yof

Works with no AI. More AI choices later.

No AI

AI on your computer

Your own AI key

yof AI: our own engine