yof is in early access. Join the waitlist to get it first.Join the waitlist

yof by sōtem · Early access

Your AI built it. yof checks it, explains it, guards it and watches it.

Early access: join the list and we'll check your app first.

yof: your code's best friend. Catches leaked keys, open databases and risky changes before you ship. Free for your own apps, private, any AI.

acme/my-shopPR 4821/3
yofbotsupabase/migrations/0003_customers.sql

Fix nowAnyone can read your customers' emails

Your customer list is open to the public. Anyone who finds your app's address can download every email in it.

create table customers (id uuid primary key, email text, user_id uuid);
+ alter table customers enable row level security;
+ create policy own_row on customers for select using (auth.uid() = user_id);
Copy fix for your AIc
AI
Your AIcoding agent9f2c4a1

Turned on row level security. Each person can now read only their own row.

yofbotPassed

Checked again. The table is closed. Nothing else changed.

acme/my-shopPR 4821/3
yofbotsupabase/migrations/0003_customers.sql

Fix nowAnyone can read your customers' emails

Your customer list is open to the public. Anyone who finds your app's address can download every email in it.

create table customers (id uuid primary key, email text, user_id uuid);
+ alter table customers enable row level security;
+ create policy own_row on customers for select using (auth.uid() = user_id);
Copy fix for your AIc
AI
Your AIcoding agent9f2c4a1

Turned on row level security. Each person can now read only their own row.

yofbotPassed

Checked again. The table is closed. Nothing else changed.

Preview: how yof will work

AI writes fast. Mistakes ship faster.

An assistant can build a whole app in an afternoon. It can also leave a door open without telling you. yof follows every change and brings it back to one clear answer: safe to share, or what to fix first.

01 Catch

Find the open doors before someone else does

yof will look at your app the way a stranger would, and list what is exposed: keys, customer data, pages without a lock.

Preview: how yof will work
acme/my-shopPR 4821/3
yofbotsupabase/migrations/0003_customers.sql

Fix nowAnyone can read your customers' emails

Your customer list is open to the public. Anyone who finds your app's address can download every email in it.

create table customers (id uuid primary key, email text, user_id uuid);
+ alter table customers enable row level security;
+ create policy own_row on customers for select using (auth.uid() = user_id);
Copy fix for your AIc
AI
Your AIcoding agent9f2c4a1

Turned on row level security. Each person can now read only their own row.

yofbotPassed

Checked again. The table is closed. Nothing else changed.

Join the waitlist

02 Explain

Plain words, and a fix you can paste

Every finding will say what is wrong, why it matters to you and how urgent it is. Then yof writes the fix as a prompt for the AI you built with.

Preview: how yof will work
Ask yof about this findingmy-shop.appMostly healthy

Findings

Open findings9
Fix now2
Fix this week3
Nice to have4
Passed31

Rules

.yof.yml2
Fix nowToday2
YF-12 · supabase
Anyone can read your customers' emails
Your customer list is open to the public. Anyone who finds your app's address can download every email in it.
Fix nowdatabaseauth
YF-14 · src/lib/ai.ts
Leaked keys
Keys and passwords anyone can copy from your code.
Fix nowkeys
Fix this weekThis week3
YF-03 · app/api/admin
The admin page opens without signing in
Admin pages and routes that open without signing in.
Fix this weekroutes
YF-07 · package.json
Update a package to its safe version
Parts of your app with a published weakness.
Fix this weekdepsCVE
YF-09 · middleware.ts
How urgent
Fix now, fix this week, or nice to have.
Fix this weekroutes
Nice to haveThis week4
YF-21 · app/layout.tsx
Shared links show no title or picture
What could really happen, like a bill, a leak or a broken page.
Nice to haveseo
YF-22 · package.json
No made-up or unsafe packages
Add-ons your AI invented, or a lookalike of a real one.
Nice to havedeps
YF-25 · next.config.js
Everyday words
What happened, not the technical name.
Nice to haveheaders
Ask yofFix now
What does this mean?
Your app keeps customer details in a database. Right now it has no lock, so anyone can read it. The fix adds a lock so each person sees only their own details.
Ask yof about this findingCopy fix for your AI
Join the waitlist

03 Guard

A guard that follows your rules

yof is an agent with a rules file. It can comment on, warn about or block a risky change, and it never pushes, merges or deletes anything on its own.

Preview: how yof will work
Openfeat(account): delete account endpointacme/my-shop · PR 91 · 3 filesMerge blocked by yof
Findings
app/api/account
  route.ts 1
  route.test.ts
lib
  auth.ts
.yof.yml
Your rules
RelaxedBalancedStrict
app/api/account/route.ts-0+2viewed
18export async function DELETE(req: Request) {
19 const { id } = await req.json();
20 await db.account.delete({ where: { id } });
21 return Response.json({ ok: true });
22}
18export async function DELETE(req: Request) {
19 const { id } = await req.json();
20 const user = await currentUser(req);
21 if (user?.role !== "admin") return forbidden();
22 await db.account.delete({ where: { id } });
23 return Response.json({ ok: true });
24}
yofbotMerge blocked by yof

This change lets anyone delete accounts.

+ const user = await currentUser(req);
+ if (user?.role !== "admin") return forbidden();

Suggested change. yof never commits it for you.

.yof.ymlFrom .yof.yml in your project
profile: balanced block: - secret_leak - open_database - auth_bypass warn: - missing_meta - outdated_package never: - push - merge - delete # reviewed like code
Join the waitlist

04 Watch

Still watching after launch

Once your app is live, yof will check it every day and send one short email: all good, or the one thing to fix.

Preview: how yof will work
App health/OverviewCheck now
Overview
Check history by appFix now · Fix this week · Passed
web28/30
api42/42
auth13/14
workers9/9
Findings over timewebapiPassed
Findings by severity
Fix now2Fix this week3Nice to have4Passed31
See the dashboard preview

Any AI

Use the AI you like, or none at all

A · No AI.envpackage.jsonCVEroutes/

For developers

The same checks, from your terminal

A command, a commit hook and a pull request check. SARIF for code scanning, a baseline for old projects, and pull requests from forks never see your secrets.

Preview: how yof will report
An illustration of the planned output, not a recorded run. yof is still being built.

The install line arrives on launch day. Until then there is nothing to install, so there is nothing to copy.

Before every commit

A quick key check runs before code leaves your computer, and stops the commit if a key would leak.

On every pull request

One comment that updates in place, with a block only when your rules say so.

In your own CI

SARIF for code scanning and a baseline for old projects, so only new problems fail the build.

Promises

What yof promises

  • Runs on your side

    On your computer or in your own CI. Your code goes only to the AI you pick.

  • No telemetry

    yof will not report on you or your project to anyone, us included.

  • Keys stay hidden

    Any key yof finds is hidden before anything is sent to an AI.

  • Open source (Apache 2.0)

    The code goes public on launch day, so anyone can read exactly what it does. Free for your own apps. Team dashboard and history in sōtem.

  • Only reads public pages

    On a live site it never attacks, logs in or floods anything.

  • Honest about limits

    It can't prove an app is completely safe. It says what it checked and what it didn't.

Hear the day yof is ready

yof is still being built, so there is nothing to install yet. Leave your email and we'll write once, when you can try it.

Get early accessSee the dashboard preview