FAQ
Does offramp send my code anywhere?
No. It runs on your machine, reads only the files in your repository, and makes no network request. Nothing leaves your machine unless you choose to share the report.
Does it need credentials or access to my app?
No. It needs no account, API key or cloud credential, and never contacts your running app.
Will it change my code?
No. It writes only report.md and report.json to the directory you pass to --out.
Which apps does it support?
It is built and tested on apps made with Lovable (including their Supabase database rules) and with Emergent. It runs on any other repository too: the checks that do not apply report "not applicable", and the rest, such as committed credentials and secrets in the frontend, still run.
What do I need to run it?
Python 3.11 or later, and a copy of the repository. See run an audit.
Is a clean report a guarantee that my app is secure?
No. It means none of the checks found a problem in the files. Some risks cannot be seen from a repository at all; the report lists them, and so does this page.
A finding is wrong. What do I do?
Open an issue with the finding's id. See accuracy.
Who maintains offramp?
DevOps Genie. The tool is MIT-licensed, and its reports name no vendor, including us.