See what an AI agent could lift from your app. Close it in one command.

How it works

It reads, rates and explains. Then it asks.

1. 1

   Run it where you build

   In a JavaScript project it finds the build output by name: dist, .next/static, out, build. Of a server-rendering build it reads what browsers load, not the server's own code. Anything else, a folder, an app, a program or an archive, it reads as given.

2. 2

   Read the rating

   The report opens with the rea risk, then every finding, worst first, with what it exposes and how to close it. It also says what it did not read, and opens the same result as a page in your browser.

3. 3

   Say yes to the fix it can make

   It lists the source maps it can take out and, after a y, moves them to a backup outside your project. npx reaproof undo puts them back.

4. 4

   Close the rest, run it again

   Each finding names the setting to change. A finding that is gone is fixed. The report ends with what to do next.

Every report opens with one of these

• [very high]

  A tool like rea can take your original source or your secret values as they are.

  A source map that holds your source; a .env file, a .git folder or a server-only key in what ships.

• [high]

  Near-secret values, data, or the inside of the running app are exposed.

  A database file or debug symbols in the output; a test key; a program signed with get-task-allow.

• [moderate]

  Something left in makes the code easier to read, or the running app easier to get into.

  Code that is not minified; source maps that list file names; a program that kept its development names.

• [baseline]

  None of the leaks this tool looks for was found.

  Code structure, the text in it and server addresses are still readable, as in any shipped app.

• [not rated]

  What ships could not be read, so no rating is given.

  A disk image, an installer or an archive it does not open. It does not mean nothing leaks.

There is no "safe" level, because there is no such state. Screen structure and the server addresses an app calls stay readable in any app.

Benchmarks

Measured, and checked against the tools that define the answer

Right answers on framework builds

Built on 2026-10-18 in Docker with Next.js 16.4.2, Vite 8.3.4, SvelteKit 3.1.0, Nuxt 4.6.2, Astro 7.4.0 and React Router 8.4.0, each built right, with source maps on, and with a server key handed to browser code. The false alarms of 0.7.0 came from reading server code, which does not ship. With neither a .env file nor the environment, a token of the app's own, in no vendor's format, cannot be told from any other value. How the apps were built

Same answer as the reference tool

Speed on real builds

Median of three runs of reaproof <target> --json with 0.8.0 on 2026-10-18, on an Apple M4 Pro with Node 24.14.0, Node's own start included, in a shell with two variables named like a secret, which it compares with what ships. Size is the file or folder on disk. Details of every check are in the guide.

What it checks

The leaks that make an app easy to copy

Also: code that is not minified, source and test files packed in, long AI prompts in client code (a guess), and every server address your code names. Want rea's own view? reaproof measure runs the real rea on your output and counts what it reads, after asking. Every finding, with its severity and fix

Ways to use it

Yourself, with your agent, or in CI

What you can point it at

Web, desktop, mobile, programs and the archives they ship in

Not opened yet: .dmg, .pkg, .7z, .rar, .tar.xz and .tar.zst. The report lists them as unread, never as clean.

Ready for CI and review

Made to sit in a release pipeline

permissions:
  security-events: write
steps:
  - uses: actions/checkout@v7
  - uses: actions/setup-node@v7
  - run: npm ci && npm run build
  - run: npx reaproof --sarif > reaproof.sarif
  - uses: github/codeql-action/upload-sarif@v4
    if: ${{ !cancelled() }}
    with:
      sarif_file: reaproof.sarif

Real runs

What the report said, word for word

Get started

Your first check, in four steps