Furnace parses your application's actual Abstract Syntax Tree to verify authentication, secrets, route guards, and abuse limits before you deploy to production.
mkdir furnace-alpha && cd furnace-alpha && curl -fsSL https://github.com/vyshwas/furnace-dist/releases/download/v0.6.2-alpha.1/furnace-v0.6.2-alpha.1.tgz | tar xz && ./install.sh
Static clearance criteria executed locally on your machine with zero source code sent to external servers.
Detects production API tokens, private keys, and database credentials accidentally embedded in client bundles, commit artifacts, or unsafe environment fallbacks.
Parses the actual AST route execution paths across Express, Next.js, and Fastify to ensure every sensitive endpoint strictly enforces verified login sessions.
Verifies object-level tenant boundaries. Checks that query filters enforce user ownership and prevent cross-tenant data leakage.
Flags administrative handlers, migration scripts, and maintenance tools accidentally exposed on public network surfaces without explicit role verification.
Ensures that unauthenticated endpoints, SMS dispatchers, LLM inference routes, and file upload handlers carry deterministic rate limiters to prevent billing exhaustion.
Detects mass assignment vulnerabilities (e.g. passing unvalidated req.body directly into database schemas), SSRF sinks, and arbitrary URL redirects.
Checks payload boundaries and type coercion. Verifies schema enforcement on incoming requests and guards against path traversal in file download endpoints.
Audits CORS configuration, cookie security directives (HttpOnly, Secure, SameSite), security headers, and production sourcemap leakage.
Traditional linters match keywords. Furnace evaluates the execution graph of your syntax tree.
Standard pattern search inspects text keywords. If a route file contains a function named requireAuth, it assumes the endpoint is protected:
Because the keyword appears in the file, naive scanners mark this route as guarded. In production, unauthenticated attackers can delete arbitrary accounts.
Furnace parses code with Babel into an Abstract Syntax Tree. It traces the actual execution graph of middleware callbacks and handler functions:
Furnace does not care what functions are named. It only passes what it can prove executes before state mutations take place.
Every finding includes exact file citations, code mechanism explanations, and ready AI fix prompts.
Proven vulnerabilities that compromise the system. The report lists the exact file and line number, the vulnerability mechanism, and a ready prompt for your AI assistant to repair it.
Architectural ambiguities that cannot be proven purely from source code (e.g., endpoints intended to be public by design). Settled explicitly in furnace-launch.json.
Hardening recommendations (such as helmet headers, production cookie flags, or public form rate limits) that improve security posture without stopping deployment.
Review an unedited Launch Audit report generated from a live codebase. Inspect the line-by-line evidence, verified findings, dropped false alarms, and generated code patches.
Paid from day one. No free tier. Two ways to buy.
Founding price for the first 10 audits, then $299. A person runs Furnace on your project, checks every finding by hand, and sends you a signed report that says what to fix first. Includes 30 days of Pro for that project. You pay before the audit starts. If it finds nothing you need to fix before launch, you get your money back.
The scan, the verdict and a plain-English list of problems, all on your own computer. Also live checks on your running app, a review of each new block of code, a fix prompt for your AI tool on every problem, a check on every pull request, and a receipt we countersign. Our countersignature shows that a Pro account submitted this exact report on this date. It does not mean we checked the report. Billed monthly, in advance. Cancel any time; your plan runs to the end of the month you paid for. Full refund within 14 days of your first payment if Furnace can't check your app.
Plain answers about what Furnace checks, what it doesn't, and what it costs.
Not by default. AI tools often produce apps that work but have common holes: routes with no login check, missing ownership checks so one user can edit another user's data, fallback secrets in code, and database tables with no access rules. Check before real users arrive.
Run Furnace on the project folder. It reads the code and returns READY, NOT READY or NOT SURE YET, with each problem listed alongside a fix and a prompt you can paste into your AI coding tool.
An AI review can change between runs and can miss problems with full confidence. Furnace's check uses fixed rules and no AI model, so the same code always gets the same answer, and when it cannot read something it says NOT SURE instead of passing it.
No. The code check runs on your own machine and sends nothing off it.
Login and permission checks on every route, ownership checks on records, exposed secrets (including keys deleted from git history), database rules such as Supabase row rules, rate limits, and vulnerable dependencies.
It reads JavaScript, TypeScript and Python projects. It is an early alpha, tested on Windows; Linux is not verified yet.
The Launch Audit is $99 at the founding price (limited to 10), with your money back if there is nothing to fix. Furnace Pro is $19 per month.