What in your app could cost you a fine, a chargeback or a surprise bill?

Pick your project folder or a built site. Liability Audit reads it locally and reports the common, cheap-to-fix exposures. It checks for trackers with no consent step, subscriptions with no renewal or cancellation terms, a missing privacy notice or terms, affiliate links and AI with no disclosure, and tax, legal or medical tools with no "not advice" line. It also checks for live keys in the tree, LLM endpoints anyone can spend on your key, cloud with no budget alarm and strong-copyleft dependencies. Each finding shows where it is, the law or rule behind it, and the fix.

Nothing is uploaded: files are read by this page in your browser and never leave your device. Findings are observations to check, not legal advice.

1. Choose what to scan

A project folder (source, built pages, *.tf, package-lock.json); node_modules and .git are skipped …or paste one page's HTML

3. Keep it checked: CLI and CI

node cli.mjs scan .                       # text report
node cli.mjs scan . --format md           # a PR comment
node cli.mjs scan . --format sarif > la.sarif   # GitHub code scanning
node cli.mjs scan . --fail-on high        # CI gate
node cli.mjs rules                        # every rule and the law behind it

Read what a small app can be liable for, and how to check for the reasoning behind each rule and the limits of an automated scan.

Questions

Does a clean report mean my app is compliant?

No. It means none of the patterns this tool looks for were found in the files you gave it. It cannot see your servers, your contracts, what your vendors do with data, or what your pages say in images. It is a checklist that finds the common, cheap-to-fix problems early; it is not legal advice and not a compliance certificate.

Why does an LLM endpoint without a rate limit count as a liability?

If your server calls a model on your own API key and anyone can reach that endpoint, one abusive user, a scraper or a stuck agent loop can run up the bill, and the provider charges the account owner. A per-user budget or rate limit in front of the call caps that exposure.

Is my code uploaded?

No. The page reads the folder or text you choose in your own browser and never sends it anywhere. The CLI reads local files and makes no network request.

Can I run it in CI?

Yes. node cli.mjs scan . --fail-on high exits 1 on any high-severity finding, --format md writes a PR comment, and --format sarif produces a file GitHub code scanning can show inline.