Stop risky checkout patterns before they ship.
Designed to make UI-pattern review an automated gate instead of a pre-launch scramble.
Illustrative CI view — real rule ID, gate and SARIF flow
Risky UI slips out quietly — and surfaces loudly.
Reset countdowns, sneaked basket items, shaming decline buttons. They creep in through small decisions and get discovered after release.
Lint every build for it.
Static checks plus behavioural probes on a pinned local Chromium, gated by a policy file your team versions. Findings block builds via exit codes and SARIF.
Build → gated release.
Terminal, SARIF, policy, pipeline, evidence.
Real command and rule ID
Uploads to code scanning natively
Your stance, versioned in git
Drops into an existing workflow
Inline where the code is reviewed
Proven by behaviour, not copy
The same three views, on every product.
An evidence card, a timeline and a trust score — identical components everywhere, so what you learn on one product transfers to the next.
What changes after you adopt it.
Patterns caught in review, not in the pressEvery build checked before release — automatically.
One consistent stance across teamsA versioned policy file replaces tribal knowledge.
An auditable trailFindings, gates and suppressions recorded — nothing vanishes silently.
Designed for zero data-exposure reviewNo egress means no security review of a scanning vendor.
Detection designed to be defensible.
Behavioural urgency proof
A timer that resets on reload — or repeats for a fresh session — is flagged on behaviour.
Basket line-item diff
Unconsented additions caught; whole-name allowlists stop naming tricks.
Scoped classifier
Only decline-button text is classified — that's what keeps precision defensible.
Policy-as-code
Severities, allowlists, suppressions — validated strictly, versioned in git.
Zero egress
No runtime downloads, no network calls — license checks included.
CI-native
SARIF to code scanning, exit codes for gating, trend regression checks.
Output is a QA signal for internal review — explicitly not a legal determination. The classifier is a deterministic lexicon; no headline accuracy number is advertised until the evaluation corpus statistically supports one.