what was added directly?
packages and versions named in your project manifest.
AI build receipt for AI-made apps
see what your AI actually installed.
most security tools start with vulnerabilities. we start with the build itself: what was added directly, what came with those packages, and what can run without another prompt.
direct vs inherited
automatic execution traced
facts separated from assumptions
build trace
the build leaves a trail.
direct choices, inherited packages, and automatic execution become a readable receipt.
declared
31
direct packages
resolved
312
packages mapped
reviewed
23
areas to inspect
sample receipt
free preview
get the receipt your AI never gave you.
we separate packages declared directly from everything they pulled in. upload one package manifest and one supported lockfile to see what shipped beneath your prompt.
preview complete
your project has areas to review.
use this build receipt to choose what to review first. it is not a generic security grade or proof that the app is unsafe.
0risk signal
your free preview
0 findings revealed. 0 deeper checks stay locked.
the preview uses deterministic rules. the full AI audit has not started, and no paid findings were sent to this browser.
report access0%
pay once to start the private full audit
full intelligence
0 deeper analysis areas stay locked.
Enter your email before checkout. Stripe confirms the $9 payment, then we send one private audit to that address.
AI build dependency maplocked
permission + reach analysislocked
environment exposure boundarieslocked
maintainer concentration signalslocked
post-install behaviorlocked
recommended fixes in orderlocked
one AI build receipt
$9 one-time · one app · no subscription email → $9 payment → private report linkfull report
understand what shipped beneath your prompt.
the build receipt answers the questions an AI coding agent usually leaves behind.
what came with it?
transitive packages installed underneath the tools you selected.
what can run?
install scripts, build hooks, and automatic execution paths.
what can it touch?
filesystem, network, process, and environment exposure.
who maintains it?
release recency, maintainer concentration, and ownership changes.
what matters first?
plain-language priorities with evidence and recommended action.
our rule
report reach.
never invent intent.
manifest data cannot prove whether you or the agent chose a package. it can prove what the project declares directly, what arrived underneath it, and where automatic execution appears. every report separates:
- verified what the files and metadata prove
- inferred what the evidence reasonably suggests
- unknown what requires deeper inspection
access
one app. one clear receipt. nine dollars.
start with one AI-built app. builder and agency access can follow when repeat scans become useful.
- 1 complete build report
- direct + inherited package map
- execution and reach evidence
- prioritized recommendations
- multiple scans each month
- change tracking between audits
- project history
- new-risk alerts
- multiple client projects
- team access
- white-label reports
- API + workflow support
build fast. know what shipped.