Versions
Tofu checks your code before every update goes online. , things that could harm other people or code the check couldn’t read, stop the update; your current version stays online. Choices that only affect your own app are warnings and never stop it, and anything that looks suspicious but isn’t serious is shown for you to look at.
No serious problems found
This check looks for common mistakes, not everything. See what this check covers below.
Checked just now · all 43 code files read
What this check covers
This check catches common, serious mistakes. It can’t promise your app is safe. Here’s what it looks at, and what it doesn’t.
Tofu read all 43 of your code files. Downloaded libraries and generated files are skipped.
- Secret keys left where visitors can see them
- Database tables anyone could read or change
- Payment and sign-in settings that could be abused
- Forms that send passwords to another site
- Scrambled or hidden code
- Libraries and install scripts known to be risky
- Known scam and data-theft patterns
- Cryptocurrency miners, in the app or in visitors’ browsers
- Proxies and VPN servers that pass on other people’s internet traffic
How your app behaves once it’s running, what’s inside your database, keys saved only in Keys & settings, and harmful code that’s deliberately hidden.
A deeper report doesn’t exist yet.
Technical details
No blocking finding among the checks that ran.
Read 43 of the 43 files the scan was given. The files the upload kept: the archive minus dependencies (node_modules), VCS data (.git), build output (dist, build, .next), local virtualenv/cache trees and system noise, plus whatever the upload itself withheld. Checks that ran: tripwire:committed-secret, tripwire:credential-form-off-origin, tripwire:crypto-wallet-phishing, leaked-service-key, rls-disabled, open-write-policy, unverified-payment-webhook, missing-email-auth, redirect-allowlist, obfuscated-code, install-scripts, secret-exfiltration, wallet-drainer, clone-execution, dependency-risk.
Not checked: Malware outside the shapes these checks match — they recognise known patterns (obfuscated execution, install-time downloads, exfiltration, wallet draining, clone-time hooks, curated bad dependency versions), not intent; What the app does once it runs — runtime behaviour, its network traffic, anything after deployment; The database itself: its contents, and any access rule the project does not state in a file that was read; Dependencies in full — only the direct entries in package.json are matched, against a curated list of published incidents: no lockfile, no transitive packages, no advisory feed; Secrets that exist only in the deployment environment rather than in these files.
This verdict covers only the files and checks above — no other review of this code is part of it.
The safety check runs on the code you uploaded, before your app serves its first byte, and a finding of critical or high severity blocks the deployment instead of shipping it. Only what could harm other people or Tofu is graded critical or high — malware, phishing, a leaked key, a cryptocurrency miner, a server that relays other people’s traffic; a choice that risks only the app’s own data, such as a table anyone can edit, is a medium warning that is the owner’s call and never blocks, and a weaker sign of harmful code is a medium or low finding that does not block but is worth a look. It is not a general malware scan: it matches the shapes it knows and states, for every result, what it read and what nothing in it looks for — so a pass is never a statement that the code is safe. A deeper, itemized security report is not implemented yet: Tofu does not produce one, and nothing on this page is generated from one.
- Checks that ran
- tripwire:committed-secret, tripwire:credential-form-off-origin, tripwire:crypto-wallet-phishing, leaked-service-key, rls-disabled, open-write-policy, unverified-payment-webhook, missing-email-auth, redirect-allowlist, obfuscated-code, install-scripts, secret-exfiltration, wallet-drainer, clone-execution, dependency-risk